Cryptography and Security · Cross-listed from quant-ph
Optimal Quantum Differential Privacy via Fisher Information Spectral Analysis
Justice Owusu Agyemang, Jerry John Kponyo, Elliot Amponsah et al. (+1 more)
The
Quantum Fisher Information (QFI) metric governs a fundamental duality: it quantifies both how precisely a parameter can be estimated (metrology) and how distinguishable two
quantum states are (
privacy). We exploit this duality to establish a geometry-aware framework for
quantum differential
privacy (DP) that replaces isotropic depolarizing noise with direction-dependent noise aligned to the QFI eigenstructure of the
quantum embedding. We prove six principal
theorems: (1) the minimax-optimal mechanism concentrates the noise budget in the dominant QFI eigenmode, achieving $\varepsilon = (\Delta^2/2)\lambda_{\max}(1-c\gamma)$ with $O(d/\lambda_{\max})$ advantage; (2) mixed-state QFI decomposition reveals that dephasing in the adversary's basis $\textit{increases}$ accessible information, while misaligned-basis dephasing provides constructive
privacy amplification from hardware noise; (3) a tight
privacy $-$ utility uncertainty relation $\varepsilon \cdot (1 - F) \ge \frac{\Delta^2}{2}\frac{\operatorname{Tr}(F)}{d}$; (4) adaptive QFI estimation converging at $O(1/\sqrt{n})$ yields $1.92\times$ tighter bounds; (5) QFI-aligned composition saturates at $O(1)$ versus $O(k)$ for standard composition; and (6) hardware noise can be harnessed for
privacy amplification.
Adversarial vulnerabilities, Wasserstein guarantees, subspace projection, and a zero-knowledge audit protocol follow as corollaries. Results are validated on Qiskit Aer GPU simulations, IBM
Quantum hardware (ibm_fez, 156
qubits), and against classical DP baselines, achieving equivalent utility at $\varepsilon \approx 0.001$ versus $\varepsilon \approx 4800$ for classical DP.
Read the full abstract ▾
All authors Justice Owusu Agyemang, Jerry John Kponyo, Elliot Amponsah, Godfred Manu Addo Boakye
Cryptography and Security
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
Shi Liu, Xuehai Tang, Xikang Yang et al. (+4 more)
The rise of tool-using Large
Language Model (LLM)
agents, standardized by protocols like the Model Context Protocol (MCP), has unlocked unprecedented autonomous execution capabilities for LLM
Agents by integrating external open-domain knowledge and tools. However, this interoperability introduces a covert attack surface targeting the
agent's cognitive planning layer. This paper systematically investigates Tool Description Poisoning (TDP), a novel semantic attack. In TDP, malicious instructions are not embedded in a tool's executable code, but rather covertly injected into its descriptive metadata, the very "manual" an
agent relies on for secure planning and decision-making. To rigorously and systematically evaluate this emerging threat, we introduce the MCP-TDP Security
Benchmark. This high-fidelity sandbox environment comprises 32 realistic, real-world test cases spanning 6 distinct risk categories. Our evaluation of 8 mainstream LLMs reveals severe vulnerabilities, with leading models like GPT-4o exhibiting a nearly 100% Attack Success Rate (ASR) in six high-risk scenarios. Furthermore, our findings demonstrate that common
prompt-guardrail defenses are largely ineffective and can, counterintuitively, even be counterproductive (a phenomenon which we term the "Firewall Fallacy"). Crucially, we also propose a defense mechanism: "Reactive Self-Correction," where an
agent autonomously detects and reverts its own malicious actions post-execution. This work provides the first specialized security
benchmark tailored for TDP, offering essential insights for securing the cognitive and planning layers of advanced agentic systems.
Read the full abstract ▾
All authors Shi Liu, Xuehai Tang, Xikang Yang, Liang Lin, Biyu Zhou, Wenjie Xiao, Wantao Liu
Cryptography and Security
Microbenchmarking Cloud Cryptographic Workloads for Privacy-Preserving Healthcare IoT
Jeremiah L. Webb, Laxima Niure Kandel, Deepti Gupta et al. (+1 more)
Cryptographic operations are an essential component of cloud security architectures; their comprehensive performance characterization across different cloud services, hardware architectures, and programming
language implementations remains unknown. Specifically, healthcare IoT devices are highly vulnerable and frequently targeted, yet the cryptographic performance trade offs in their cloud security architectures remain poorly understood. This research presents an extensive microbenchmark study evaluating the performance of core cryptographic workloads, including SHA HMAC generation, AES encryption, decryption,
Elliptic Curve Cryptography (ECC) signature generation and verification, and RSA encryption, decryption, across Function as a Service (FaaS) integrated with Key Management Services (KMS) from Amazon Web Services (AWS) and Microsoft Azure. We evaluate FaaS platforms using Elastic Compute Cloud (EC2) instances and Azure Virtual Machines, specifically using burst optimized instance types to analyze performance under typical cloud workload patterns. The
benchmark encompasses a comprehensive multi dimensional analysis spanning two CPU architectures (x86 64 and Arm64), six widely adopted programming
languages (Rust, Go, Python, Java, C#, and TypeScript), multiple
memory allocation configurations, and diverse instance types to capture the complex interplay between these factors. This study identifies optimal configurations for cryptographic workloads in FaaS environments, improving performance and cost efficiency while enabling secure and timely data protection for healthcare IoT applications.
Read the full abstract ▾
All authors Jeremiah L. Webb, Laxima Niure Kandel, Deepti Gupta, Lavanya Elluri
Cryptography and Security
Verifiable Secure Aggregation via Dual Servers with Linear Tags in Federated Learning
Yufei Zhou
Federated learning (FL) enables collaborative model training by aggregating local updates without requiring raw data sharing. However, prior studies have shown that servers can exploit gradient inversion to compromise user
privacy or manipulate aggregation results, undermining the utility of the global model. To address these concerns, we propose a secure and verifiable aggregation scheme with lightweight cryptographic primitives for FL. Our method leverages pseudo-random functions (PRFs) and a non-colluding dual-server architecture to achieve secure aggregation with mutual server verification, while maintaining communication overhead comparable to plaintext aggregation and a constant verification tag size. Crucially, it preserves user
privacy and achieves end-to-end secure aggregation with verification. Moreover, our scheme significantly reduces both user computation and verification overhead, making it suitable for FL with a large number of participants. For instance, with an input dimension of 20K, user computation time is reduced to 18 ms, approximately 7$\times$ faster than OPSA, while verification time decreases to 9.5 ms, approximately 2.4$\times$ faster than OPSA.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.DB
CHRONOS: Temporally-Aware Multi-Agent Coordination for Evolving Data Marketplaces
Joydeep Chandra
Temporal knowledge-graph data marketplaces face three coupled failures in static designs: stale hybrid index shortcuts reduce recall as edges evolve, stationary Shapley pricing misattributes value after distribution shifts, and uncoordinated
agents over-consume a shared differential-
privacy budget. We present CHRONOS, a three-layer architecture providing a unified treatment of these challenges with explicit public and private separation. Layer one applies neural-ODE temporal decay to shortcut edges, providing a per-query expected recall-loss bound of Big-O of Pq lambda delta t, with a monotone-envelope guarantee reducing bound looseness to 1.8 to 3.2 times observed loss. Layer two conditions Shapley valuation on detected changepoints and provides finite-sample error guarantees under noise. Layer three uses EXP3-IX to achieve Big-O of the square root of T log T regret while enforcing epsilon and delta differential
privacy via moments accounting. CHRONOS releases a privatized affinity
matrix per epoch using the Gaussian mechanism; all
retrieval and ranking are post-processing, incurring no extra
privacy cost. We provide multi-epoch settlement, scalability analysis for 500 sellers, and comparisons against accelerated baselines. Across four
benchmarks, CHRONOS shows 0.937 recall at ten, 2.74 queries per second, 161 ms latency, and total epsilon of 4.25 at delta of 10 to the power of negative 6 under zCDP composition. These results indicate a competitive operating point. A limitation is that at this
privacy level, released valuations remain noise-dominated; utility derives primarily from public index routing and adaptive scheduling driven by low-sensitivity statistics.
Read the full abstract ▾
Cryptography and Security · Cross-listed from stat.ML
On the Stability of Spherical Hellinger-Kantorovich Flows and Their Implications for Differential Privacy
Aratrika Mustafi and Soumya Mukherjee
Gradient-flow sampling interprets a Gibbs distribution as the minimizer of an energy functional over probability measures and generates dynamics converging to this target. Under spherical Hellinger-Kantorovich (SHK) geometry, the flow couples transport and reaction and coincides with birth-death Langevin dynamics. In this work, we develop a perturbation theory for SHK gradient flows. For two potentials $V$ and $V^{\prime}$, we compare the associated flows from a common initialization and quantify how potential discrepancies propagate over time. A uniform perturbation bound yields dimension-free, pointwise control of the log-likelihood ratio and Rényi divergence, while additional structure allows us to derive bounds for the KL divergence as well. We apply these results to approximate sampling for the exponential mechanism in differential
privacy. The likelihood-ratio control provides explicit time-dependent Pure-DP guarantees for SHK-based samplers, while the KL bound yields Approximate-DP certificates via hockey-stick divergence. We also derive a utility bound separating intrinsic exponential-mechanism suboptimality from finite-time sampling error.
Read the full abstract ▾
Cryptography and Security
A blueprint for constructing 3-pass AKE protocols under commitment-based models
Rodrigo Martín Sánchez-Ledesma
The commitment-based AKE model provides a formal security framework for key exchange protocols that avoid long-term cryptographic material, achieving authentication through a final out-of-band verification of session-derived values. Within this model, secure KA-based and KEM-based protocols were previously constructed via a commitment-based MT compiler, yielding optimized 4-pass protocols. In this work, we show that 3-pass protocols secure under this model exist for both primitives. These protocols are constructed ad hoc, following the core ideas of the commitment-based MT authenticator, and their SK security in the unauthenticated model is proved using the same game-based techniques, achieving bounds of the same form as those previously achieved. The resulting protocols provide one-way authentication in three message exchanges.
Read the full abstract ▾
Cryptography and Security
Validating Threat Modeling Results with the Help of Vulnerable Test Applications
Oleksandr Adamov, Davide Fucci, Felix Viktor Jedrzejewski et al. (+2 more)
Validating threat modeling results remains difficult because completeness is hard to judge without an external oracle. Existing studies often rely on expert-produced reference models and other human baselines, but these can contain omissions or disagreements. This paper evaluates a complementary, vulnerability-grounded validation approach. We apply threat modeling to intentionally vulnerable applications with a known vulnerability set to measure the number of related vulnerabilities that can be discovered. We compare ThreMoLIA, an LLM-assisted threat modeling solution developed by our team, with the Microsoft Threat Modeling Tool (MTMT) across two vulnerable applications: AzureGoat and the Vulnerable Bank Application (VulnBank). The inputs to both tools are limited to architecture, data flow diagrams, and their descriptions. The results show that ThreMoLIA achieved higher vulnerability coverage on both systems. We show that vulnerable test applications provide a practical
benchmark for assessing threat coverage and complement expert-based validation.
Read the full abstract ▾
All authors Oleksandr Adamov, Davide Fucci, Felix Viktor Jedrzejewski, Ricardo Britto, Nishrith Saini
Cryptography and Security
Less Effort, Shorter Proofs: Reinforcement Learning for Security Protocol Analysis in Tamarin
Matthias Cosler, Cas Cremers, Bernd Finkbeiner et al. (+2 more)
Tools like Tamarin and ProVerif have achieved notable success in analyzing and verifying complex real-world protocols such as EMV, 5G, and WPA2, even detecting zero-day exploits. Despite these successes, verifying such protocols remains a time-consuming, challenging task, often requiring significant human effort and expertise. In this paper, we present a reinforcement learning (RL) framework inspired by AlphaZero and AlphaProof that implements a new style of proof search for Tamarin. We have developed a stateless API for Tamarin that acts as a classical RL environment. We guide a Monte Carlo Tree Search (MCTS) by a neural heuristic that learns from completed subproofs. We evaluate our framework on 16 case studies, ranging from classical protocol models to challenging state-of-the-art protocol models from recent publications. Our method finds more proofs automatically than Tamarin's standard search and produces shorter proofs than both the standard and human-engineered heuristics. Our pipeline is applicable out of the box to assist Tamarin users in active research, reducing the human effort required. Moreover, our standardized interface provides a programmatic way for users to interact with Tamarin. Finally, our work demonstrates the promising potential of adapting RL-based methods to the Tamarin domain.
Read the full abstract ▾
All authors Matthias Cosler, Cas Cremers, Bernd Finkbeiner, Mohamed Ghanem, Niklas Medinger
Cryptography and Security
Kernel-Based ReLU Approximation for Homomorphic Encryption-Compatible Privacy-preserving Deep Learning Models
Dimitrios Sygletos, Dimitra Papatsaroucha, Marios Choudetsanakis et al. (+2 more)
As
privacy concerns in AI technologies continue to grow, Homomorphic Encryption (HE) offers a way to perform computations on encrypted data without the need of decryption during operations. However, HE is limited to addition and multiplication, making non-linear functions incompatible in their original form. This limitation has become more critical with the widespread use of Large
Language Models (LLMs), where the non-linearity of activation functions such as the Rectified Linear Unit (ReLU) poses challenges for deployment in
privacy-preserving Natural
Language Processing (NLP) settings. This paper proposes a kernel-based approximation of ReLU, enabling its use within HE-constrained settings and thus contributing a critical step toward supporting
privacy-preserving LLMs. A smooth kernel-based function, mimicking ReLU, is approximated using a second-degree
polynomial, inspired by Jackson's
theorem, to achieve low multiplicative depth. The proposed method is trained and assessed directly on
token embeddings from pre-trained LLMs and evaluated in various scenarios, from simulated and tokenized data to deep learning and
transformer models. Results show improved approximation fidelity, supporting the method's suitability for secure and
privacy-preserving inference in various tasks.
Read the full abstract ▾
All authors Dimitrios Sygletos, Dimitra Papatsaroucha, Marios Choudetsanakis, Ilias Politis, Evangelos K. Markakis
Cryptography and Security
CachePrune: Privacy-Aware and Fine-Grained KV Cache Sharing for Efficient LLM Inference
Guanlong Wu, Zhaohan li, Yao Zhang et al. (+4 more)
Large
Language Models (LLMs) rely on Key-Value (KV) caching to accelerate inference, and many serving systems further share the KV cache across users' requests to reduce redundant computation. While widely adopted, unrestricted cross-user sharing introduces side-channel vulnerabilities, allowing an adversary to infer user inputs by probing for cache reuse. Existing defenses disable sharing entirely to prevent leakage; yet such a coarse-grained strategy sacrifices substantial reuse potential, since
prompts often include large portions of
privacy-irrelevant segments, such as system instructions or publicly accessible materials. Building on this, we present CachePrune, a
privacy-aware KV cache sharing mechanism that enables fine-grained reuse of KV entries across requests. Realizing such fine granularity requires
token-level cache management, as reusable segments vary in length and position due to sensitivity masking, making reuse more complex than the fixed-size or sentence-level chunking used in existing coarse-grained schemes. Specifically, CachePrune makes fine-grained reuse practical by addressing two key challenges: accurately and efficiently deriving reusable KV segments and efficiently retrieving them over variable-length spans. We implement CachePrune on top of vLLM and evaluate it on three
datasets, showing that it eliminates direct leakage through KV cache reuse side channels while reducing TTFT by 4.5x and increasing cache hit rates by 44% compared with state-of-the-art approaches.
Read the full abstract ▾
All authors Guanlong Wu, Zhaohan li, Yao Zhang, Zheng Zhang, Jianyu Niu, Ye Wu, Yinqian Zhang
Cryptography and Security
Adversarial Vulnerability Under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection
Ahmed Sabbah, Mohammed Kharma, Radi Jarrar et al. (+2 more)
We present a longitudinal, drift-aware evaluation of
adversarial robustness across more than a decade of Android applications using static and dynamic feature representations extracted from emulator and real-device executions. The
dataset is organized into yearly slices and evaluated under three deployment protocols that emulate realistic learning scenarios: (1) same-year training and testing, (2) cross-year deployment without model updates, and (3) expanding-window retraining with cumulative historical data. Across multiple classifier families,
adversarial examples are generated using FGSM and SPSA under feasibility constraints. We measure clean performance,
Adversarial Accuracy (AA), Attack Success Rate (ASR), and introduce temporal linkage metrics – RobustDrop, $\Delta$ASR, and
Adversarial Amplification Factor (AAF) – to quantify the relationship between distribution shift and robustness degradation.nResults show that temporal separation is associated with reduced
adversarial robustness under the evaluated transfer-based feature-space setting. As the train-test gap increases, clean accuracy and
adversarial accuracy decline, while attack success exhibits configuration-dependent increases, particularly under FGSM perturbations and static features. Expanding-window retraining mitigates, but does not eliminate, robustness loss under continued distributional
evolution. These findings indicate that temporal drift should be considered when assessing the long-term robustness of intelligent detection systems under evolving data distributions and highlight the need for drift-aware robustness assessment frameworks in long-lived
adversarial environments.
Read the full abstract ▾
All authors Ahmed Sabbah, Mohammed Kharma, Radi Jarrar, Samer Zein, David Mohaisen
Cryptography and Security
When Youth Enter the Algorithmic Wild: Discovering and Understanding Potentially Harmful Teen Videos on Douyin and Kwai
Shaoxuan Zhou, Yafei Sun, Jing Zhang et al. (+1 more)
Short-
video platforms like Douyin and Kwai have become central to adolescent digital life, but they also risk exposing teens to algorithmically amplified harmful content. Despite its societal importance, the scale, mechanisms, and real-world impact of this exposure remain poorly understood. Measuring it is challenging: recommendation feeds are personalized black boxes, harmful content employs sophisticated evasion tactics, and naive crawlers fail to replicate authentic teen behavior. To bridge this gap, we propose PHTV-Scout, the first large-scale, behaviorally grounded measurement framework for Potentially Harmful Teen
Videos (PHTVs). We integrate an offline survey of 683 adolescents with a tri-module online pipeline: (1) PHTV Hunter simulates teen accounts to collect recommendation feeds; (2) PHTV Arbiter, a LoRA-finetuned
multimodal classifier, detects PHTVs with 94.29% accuracy and 96.41% precision; and (3) PHTV Analyzer performs fine-grained categorization and impact assessment. Over six months, we analyzed 186,727
videos and 51,287 comments, uncovering a troubling 6.11% PHTV prevalence–dominated by Child Sexual Exploitation Imagery (53.2%)–and revealing that harmful content thrives through covert interactions (e.g., grooming comments, self-disclosure) and active evasion (semantic camouflage, noise injection). Crucially, while Youth Mode blocks 100% of PHTVs, its low adoption (30-41%) leaves most teens unprotected. We further show that exposure is driven not by user identity but by regulation, platform
algorithms, and even passive browsing, exposing the fragility of adolescent information environments. Our findings call for a paradigm shift from reactive takedowns to proactive, human-centered safeguards.
Read the full abstract ▾
All authors Shaoxuan Zhou, Yafei Sun, Jing Zhang, Xianghang Mi
Cryptography and Security
AI Security Research Should Better Incentivize Defense Research
Youqian Zhang
This work examines an imbalance in artificial intelligence (AI) security research: the field tends to produce more work on attacking AI systems than on defending them. Drawing on related academic papers, we find biased attack-to-defense ratios across subfields, including
federated learning,
speech recognition, membership inference, large
language models, etc. The imbalance possibly means far beyond a simple count: attack papers are routinely evaluated under favorable conditions that make threats look more severe than they are in practice, while defenses are held to a stricter standard that few can meet. The result is a literature rich in demonstrated vulnerabilities and thin on usable and deployed protections. We thus argue that AI security research should better incentivize defense research.
Read the full abstract ▾
Cryptography and Security · Cross-listed from eess.SP
Communication Security and Sensing Privacy in FMCW-Based ISAC Through Signal Modulation
Murat Temiz and Christos Masouros
This study proposes a novel radar-centric signaling design and architecture for secure integrated sensing and communication (
ISAC) systems. The proposed framework is designed to provide robust physical layer security for data transmission while simultaneously enhancing sensing
privacy. It employs index modulation and phase coding over frequency-modulated continuous-wave radar (FMCW) chirps, where index modulation (IM) provides an outer layer of data security, and we explicitly design the phase coding (PC) to perturb the resulting signal's ambiguity function (AF) to enhance sensing
privacy. This design reduces the risk of unauthorized surveillance by rendering target velocity estimation practically infeasible for unauthorized passive sensing hardware (i.e., a sensing eavesdropper, S-Eve) and significantly impairing its range estimation capabilities. Furthermore, this study also presents the transmitter and receiver architectures required for effective modulation and demodulation of the proposed
ISAC signaling and for performing sensing at the legitimate sensing hardware. Simulation results show that the proposed approach achieves high data throughput while enhancing communication security and sensing
privacy.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Sample-wise Targeted Adversarial Attacks on Test-time Adaptation
Phuc Duc Nguyen and Quang Duc Nguyen
Test-time adaptation (TTA) mitigates distribution shifts by adapting models to unlabeled test inputs, but also exposes them to
adversarial manipulation. Existing class-wise targeted attacks remain suboptimal for stealthy exploitation in this setting: since TTA operates on batches, forcing a subset of samples toward a target label unintentionally pulls similar benign samples along, resulting in a conspicuously high frequency of the target label that is easy to detect. To capture a more realistic threat, we introduce a sample-wise targeted attack. Unlike prior approaches, the attacker aims to misclassify only inputs carrying an attacker-chosen trigger, while preserving a benign-like prediction distribution to evade detection. To achieve this, we propose a meta-learning-based attack with a novel priority-aware gradient
alignment strategy that explicitly prioritizes attack success. The strategy formulates the gradient update as an ellipsoidal trust-region problem, mitigating gradient conflict between the attack and stealth objectives, while providing theoretical guarantees for effective optimization of the attack objective in the presence of gradient misalignment. Extensive experiments on CIFAR-10-C, CIFAR-100-C, and ImageNet-C across TTA protocols demonstrate that our method achieves high targeted success rates while maintaining prediction behavior close to benign adaptation under multiple label-free stealth metrics, making it difficult to detect in unlabeled TTA deployment scenarios. Furthermore, we demonstrate that our attack shows strong robustness against existing defenses.
Read the full abstract ▾
Cryptography and Security
Security, Privacy, and Ethical Risks in OpenClaw
Yutong Jin, Zelin Zhang, Zhijin Lyu et al. (+1 more)
This paper systematically investigates the security,
privacy, and ethical risks, as well as the traceability challenges of OpenClaw, a locally executable AI
agent system for natural
language interaction and real-world task completion. While OpenClaw shows strong potential for personal assistance, office automation, cross-platform task management, and information integration, it also raises serious security,
privacy, and ethical concerns. By analyzing its system architecture, core functionalities, deployment model, and representative application scenarios, this paper aims to reveal the risks that may arise when such a highly privileged
agent is integrated into personal and organizational digital environments. We focus in particular on the challenges associated with persistent local storage, tool invocation, cross-context information aggregation, multi-user interaction, and the integration of plugins and external services. We argue that these issues constitute major barriers to the trustworthy deployment and widespread adoption of this technology. Finally, we summarize the open challenges in security defenses,
privacy protection, ethical governance, and traceability in
agent use, and call for joint efforts from researchers, developers, deployers, and regulators to build AI
agent systems that are safer, more reliable, and more trustworthy.
Read the full abstract ▾
All authors Yutong Jin, Zelin Zhang, Zhijin Lyu, Jianbing Ni
Cryptography and Security · Cross-listed from cs.LO
Formal Verification of Probing Security via Conditional Independence
Satoshi Kura and Katsuyuki Takashima
Side-channel attacks are a major threat to the security of cryptosystems. Masking is a widely used countermeasure against such attacks, but proving the security of masked
algorithms is error-prone without formal verification. In this work, we propose a novel approach to formal verification of noninterference properties of masked
algorithms based on probabilistic separation logic. By establishing a connection between noninterference and conditional independence, we show how noninterference can be verified using Lilac, a separation logic for conditional independence. We also provide several proof rules that facilitate the verification of probing security and demonstrate their application to example
algorithms.
Read the full abstract ▾
Cryptography and Security
Are Frontier LLMs Ready for Cybersecurity? Evidence for Vertical Foundation Models from Dual-Mode Vulnerability Benchmarks
Vivek Dahiya, Sunny Nehra, Vipul Dholariya et al. (+2 more)
We evaluate whether frontier LLMs are ready for cybersecurity through a dual-mode
benchmark: white-box function-level vulnerability detection (VulnLLM-R, across C/Java/Python) and black-box web application security testing (five production-style applications with 118 ground-truth vulnerabilities across 20+ CWE families, which we will open-source). We test six frontier models (GPT-5.4, Codex~5.3, Claude Opus~4.7, Sonnet~4.6, Gemini~3.1~Pro and Gemini~3~Flash) and two domain-specialized models across four testing paradigms. Our findings are sobering: (1)~every frontier model produces 10-50% false positive rates in white-box detection, systematically over-predicting vulnerabilities; (2)~in black-box testing, frontier models achieve only 4-8% ground-truth coverage, improving to just 10-19% even with external security tools (Playwright MCP, Burp Suite MCP); (3)~structured penetration-testing methodology encoded in domain-specialized
agents raises per-family detection above 50%, demonstrating that methodology, not scale, is the primary lever; and (4)~a domain-specialized defense model achieves the highest precision (0.904) and lowest false positive rate (9.7%) among all models, on a single GPU. We identify the absence of structured security testing traces end-to-end request/response sequences, failure-heavy data, and multi-step attack chains as the fundamental training data bottleneck, and propose self-play security testing as a data generation strategy. Our results make the case for vertical foundation models purpose-built for cybersecurity.
Read the full abstract ▾
All authors Vivek Dahiya, Sunny Nehra, Vipul Dholariya, Bhavik Shangari, Chandra Khatri
Cryptography and Security · Cross-listed from cs.IT
On APN Exponents and the Differential and Boomerang Properties of Binomials in Characteristic 3
Namhun Koo, Soonhak Kwon, Minwoo Ko et al. (+1 more)
Recent studies on binomials of the form $F_r(x) = x^r(1 + \chi(x))$ over $\mathbb{F}_{p^n}$ have shown that these functions can exhibit very low boomerang uniformity. In this paper, we focus on the specific behavior of such binomials in characteristic $3$, where instances of extremely low boomerang uniformity-namely $0$ or $1$-seem to arise more frequently than in other characteristics. First, we provide a systematic analysis of Almost Perfect Nonlinear (APN) power functions in characteristic $3$. We present an explicit parametrization of APN exponents arising from the construction of Zha and Wang and demonstrate through numerical results for $n \le 13$ that this generalized framework accounts for several previously known and sporadic APN instances. Building on this classification, we identify and rigorously prove two classes of binomials $F_r$ that are locally-PN and possess the minimum possible boomerang uniformity of $0$. These classes involve exponents derived from the aforementioned APN construction and the differentially 4-uniform exponent $r = 2 \cdot 3^{\frac{n-1}{2}} + 1$. Furthermore, we analyze the binomial $F_r$ with $r = 3^n - 3$, proving that it is locally-APN with boomerang uniformity $1$ when $n\ge 5$ is odd, and completely determine its boomerang spectrum through the evaluation of character sums. Our results clarify and extend existing studies on the cryptographic properties of binomials, providing a systematic characterization of several classes of binomials with very low boomerang uniformity in characteristic $3$.
Read the full abstract ▾
All authors Namhun Koo, Soonhak Kwon, Minwoo Ko, Byunguk Kim
Cryptography and Security
Prompt Overflow: What the Guardrail Inspects Is Not What the Model Infers
Yuanbo Zhou, Changjia Zhu, Junyu Wang et al. (+5 more)
Guardrail models (a.k.a. safety checkers) are widely deployed to screen user inputs before they reach large
language models (LLMs), serving as a primary defense against
prompt injection attacks. Due to strict context constraints, these models handle overlength
prompts through truncation or
segmentation-based inspection. While prior work has focused on semantic
adversarial inputs, the security implications of these long-input processing mechanisms remain largely unexplored. In this paper, we identify a critical blind spot arising from the mismatch between the limited inspection windows of guardrail models and the substantially larger context inference windows of downstream LLMs. We introduce a novel
Prompt Overflow Attack, which exploits this mismatch by fragmenting malicious instructions and interleaving them with benign filler content across an overlong
prompt, such that no individual inspected segment appears malicious while the full context remains actionable to the LLM. Through a systematic evaluation against state-of-the-art guardrail models, including Meta Llama
Prompt Guard, IBM Granite Guardian, and DeBERTa-based detectors, we demonstrate that
prompts reliably detected in short-context settings can evade guardrail models once adversarially manipulated into over-length inputs, yet remain fully actionable by downstream LLMs. We further propose potential defense strategies and outline mitigation directions to strengthen guardrail models.
Read the full abstract ▾
All authors Yuanbo Zhou, Changjia Zhu, Junyu Wang, Xu He, Yan Zhai, Kun Sun, Mingkui Wei, Junjie Xiong
Cryptography and Security
Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection
Kieu Dang, Phung Lai, NhatHai Phan et al. (+2 more)
Proprietary large
language models (LLMs) face risks of intellectual property (IP) violation, as adversaries can replicate an LLM by collecting input-output pairs to train a surrogate model, causing financial setbacks. Watermarks offer a promising defense to verify ownership, but existing methods often struggle with semantic distortion, factual inconsistency, and
adversarial attacks. In addition, key-conditioned watermarks for provider-specific detection, especially in cross-provider and multi-user scenarios, remain largely underexplored. To address these challenges, we propose SAFESEAL, a novel key-conditioned watermarking framework that achieves strong detectability with minimal impact on model utility, effectively balancing detectability, utility, and robustness. SAFESEAL preserves named entities while substituting linguistic terms with context-aware synonyms through a key-conditioned Tournament sampling mechanism, maintaining semantic fidelity and factual consistency. For detection, we introduce a key-conditioned contrastive detector that jointly encodes the text and key, enabling provider-specific and robust watermark verification. We derive theoretical bounds on the utility-detectability trade-off and significantly reduce latency through lightweight models, batching, and parallelism. Extensive experiments show that SAFESEAL outperforms baselines in utility, detectability, and robustness, achieving a BERTScore of 0.983, entity similarity of 0.963, a 98.2% detection rate, and the highest human ratings for text quality and content preservation, with latency comparable to the fastest baseline. To promote transparency and community-driven progress, we release the first public watermark leaderboard and an interactive demo.
Read the full abstract ▾
All authors Kieu Dang, Phung Lai, NhatHai Phan, Yelong Shen, Ruoming Jin
Cryptography and Security
PoisonForge: Task-Level Targeted Poisoning Benchmark for Instruction-Tuned LLMs
Luze Sun, Anshuman Suri, Harsh Chaudhari et al. (+2 more)
When practitioners fine-tune LLMs on unvetted
datasets, an adversary can exploit the data supply chain through task-level poisoning: inserting a small number of crafted instruction-response pairs that cause the model to embed attacker-specified entities, such as a country, in outputs for a targeted task family while behaving normally elsewhere. We introduce PoisonForge, a
benchmark that parameterizes this threat along four dimensions (bias type, poisoning mode, appearance count, and target output length) and evaluates 12 open-weight models (from 2B to 32B parameters) across five families under a primarily 1% poison budget. With only 10 poisoned examples among 1,000 fine-tuning examples, 11 of 12 models exceed a 70% attack success rate (ASR) in their most vulnerable configuration. Meanwhile, unintended leakage to non-target tasks remains below 0.5%, and models perform well on standard
benchmarks. We analyze in detail the factors contributing to attack success. We observe that multiple appearances of an entity increase the ASR, the optimal poisoning mode depends on the semantic structure of the target entity, and ASR drops monotonically with the task output length. A correlation analysis and risk prediction model confirm that poisoning design choices, rather than model scale, are the primary causes of attack success, and that these patterns generalize to predict attack success on new tasks. We release all configurations, pipelines, and analysis code to support reproducible comparisons.
Read the full abstract ▾
All authors Luze Sun, Anshuman Suri, Harsh Chaudhari, Cristina Nita-Rotaru, Alina Oprea
Cryptography and Security · Cross-listed from cs.CY
SolarChain: A Physics-Grounded Embodied IoT System for Verifiable Urban Solar Market Design
Shilin Ou, Yifan Xu, Zhenshan Zhang et al. (+2 more)
Distributed
solar markets must coordinate physical reports, economic allocation, and public settlement even when IoT data can be manipulated. We present SolarChain, a controlled
Embodied Intelligence of Things (EIoT) prototype that integrates four functions: physics-bounded screening of photovoltaic reports, persistent
agent and planner coordination, configurable allocation between producer rewards and
market liquidity, and replayable hash-linked
auditing of settlement decisions. The
benchmark combines city-level historical weather inputs with physics-modeled generation bounds and synthetic nodes, demand, trades, and scripted attacks. On 36,000 monthly records, an IQR/MAD baseline attains F1=1.000, while the rule-based adaptive verifier attains F1=0.988 and provides physically interpretable decision evidence; it is not uniformly superior across attack classes. A sensitivity sweep selects a 20/80 reward/liquidity default under the stated simulation assumptions, while showing the incentive-liquidity trade-off. These results provide reproducible evidence from a controlled prototype, not proof of deployment readiness. We release the code, data, and audit artifacts in the spirit of open science.
Read the full abstract ▾
All authors Shilin Ou, Yifan Xu, Zhenshan Zhang, Luyao Zhang, Ming-Chun Huang
Cryptography and Security
What Does the Server See? Understanding Privacy Leakage from Large Language Models in Split Inference
Mingyuan Fan, Yu Liu, Fuyi Wang et al. (+1 more)
The deployment of large
language models (LLMs) on resource-constrained devices remains challenging, spurring interest in split inference, where models are partitioned between client and server to reduce computational burden and enhance
privacy by transmitting only intermediate activations. However, the
privacy-preserving capabilities of split inference, particularly in the context of LLMs, have not been exhaustively investigated. To fill this gap, we introduce ActInv, which solves an intermediate activation matching problem to reconstruct the client's input. Extensive evaluations demonstrate that ActInv achieves high-fidelity reconstructions, even in the presence of common perturbation-based defenses such as Gaussian noise injection and activation sparsification. To systematically understand this vulnerability, we develop Perturbation Amplification Factor (PAF), a metric for quantifying a layer's inherent resistance to reconstruction. Our analysis reveals that
privacy vulnerability is not uniform across layers, with some layers being highly susceptible to leakage while others offer natural resistance. Furthermore, we demonstrate that defense effectiveness can be significantly improved by calibrating perturbation directions to maximize reconstruction error during backpropagation. Building on these insights, we design PriPert and conduct comprehensive evaluations, covering
privacy, utility, and computational overhead, to demonstrate its effectiveness.
Read the full abstract ▾
All authors Mingyuan Fan, Yu Liu, Fuyi Wang, Cen Chen
Cryptography and Security · Cross-listed from cs.HC
From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness
Faisal Haque Bappy, Tahrim Hossain, Sidratul Muntaher Meheraj et al. (+5 more)
AI coding assistants are now central to professional software development, yet their impact on how developers think about and practice security remains poorly understood. While prior work has documented vulnerability rates in AI-generated code, a more fundamental question persists: how do these tools transform security awareness in authentic, ongoing development practice? We conducted semi-structured interviews with 15 professional software engineers and observed them completing security-relevant coding tasks with AI assistance, spanning 3 experience cohorts defined by their relationship to AI tools during professional formation. We find that AI coding assistants reorganize rather than eliminate security thinking, shifting it from the act of writing code to the act of reviewing it. This transition from preventive to reactive security is structurally encouraged by interaction models that frame code generation as a functional task, leaving security as an afterthought. Notably, none of our coding session participants specified security requirements in their initial
prompts, even when they possessed the relevant knowledge, revealing a decoupling of security awareness from security behavior. We further document informal coping strategies developers had independently invented to manage AI security risk, none of which are supported by current tools or organizations, and find that the experience cohort did not reliably predict security performance. This paper contributes a practice-grounded account of how AI-assisted development reshapes the human side of secure coding, offering empirical foundations for the design of more security-aware tools, training programs, and organizational policies.
Read the full abstract ▾
All authors Faisal Haque Bappy, Tahrim Hossain, Sidratul Muntaher Meheraj, Annoor Sharara Akhand, Tasfia Tabassum, Tarannum Shaila Zaman, Raiful Hasan, Tariqul Islam