Cryptography and Security · Cross-listed from cs.IT
Local Differential Privacy with Correlated Noise Achieves Central-DP Optimal Cost
Madhura Pathegama, Srikanth Avasarala, Viveck R. Cadambe et al. (+1 more)
We study privately estimating the sum of $n$ user-held values in the presence of an honest-but-curious server. This motivates requiring
privacy not only at data release but also throughout server-side computation. We therefore adopt the local (pure) differential
privacy model, in which each user transmits a noise-perturbed value. It is well known that independent local noise typically incurs a substantial utility loss compared to the centralized model, where noise is added only after aggregation. We show that this gap is not fundamental. By carefully designing correlations among the locally added noise variables, we construct $\varepsilon$-DP mechanisms whose estimation cost matches the optimal cost achievable in the centralized setting, up to an arbitrarily small error.
Read the full abstract ▾
All authors Madhura Pathegama, Srikanth Avasarala, Viveck R. Cadambe, Juba Ziani
Cryptography and Security
The Surface You Test Is Not the Surface That Breaks
Syed Nazmus Sakib, Nafiul Haque, Shahrear Bin Amin et al. (+1 more)
Prompt-injection
benchmarks for LLM
agents typically test attacks through a single injection surface and report the resulting attack success rate as a property of the model. We ask whether those robustness conclusions remain stable when the same
adversarial content enters through a different part of the
agent interface. Using AgentDojo, we evaluate 13 LLMs across four task suites and place a byte-identical payload either in a tool output or in the tool description. This small change produces large differences in comparative robustness: 44.9% of all model pairs change their relative ordering across the two surfaces, with substantial ranking instability in every suite. The effect is especially pronounced for a small number of models, showing that a
benchmark can substantially underestimate vulnerability when it tests only one surface. We further find that this behavior has predictive structure. Using three suites to identify the riskier surface for each model predicts the more vulnerable surface on an unseen suite with 76.9% accuracy. Defense results show the same dependence, as mitigations effective against tool-output attacks can leave substantial exposure through tool descriptions. Our results show that
prompt-injection robustness is not surface-invariant and that
agent evaluations should test the surfaces on which their security conclusions depend.
Read the full abstract ▾
All authors Syed Nazmus Sakib, Nafiul Haque, Shahrear Bin Amin, Shifat E. Arman
Cryptography and Security · Cross-listed from cs.LG
NumLeak: Public Numeric Benchmarks as Latent Labels in Foundation Models
Anany Kotawala
Public numeric
benchmarks appear in pretraining, so an evaluation that conditions on a date may be measuring memorized recall rather than out-of-sample skill. We introduce NumLeak, a measurement framework that combines API-boundary probes on production models with a white-box controlled validation on an open causal LM. Top-tier frontier LLMs recall the Fama-French
market excess return at 3-seed pooled Pearson r=0.97-0.99 while staying within 0.15 within-25bps on the five sibling factors; comparable fidelity appears on U.S. unemployment, CPI inflation, and NOAA temperature. On a recent-release holdout, parse rate collapses to 21-57% but r stays at approximately 0.99 on months answered, the refuse-or-recall asymmetry a memorized channel predicts. The white-box experiment reproduces the dose-response, and logprob ranking detects memorization that open-ended generation misses, implying closed-API black-box probes understate the channel. A Sonnet "date to
market-sentiment" regression that correlates with true Mkt-RF at r=0.74 collapses to r=0.02 once the model's own recall is residualized out. A one-line system-
prompt defense blocks 99.8% of a non-adaptive single-turn suffix attack set at near-zero utility cost on conceptual and historical-narrative queries
Read the full abstract ▾
Cryptography and Security
DP-SAPF: Saliency-Aware Parameter Fine-tuning of Public Models for Differentially Private Image Synthesis
Chen Gong, Kecen Li, Zinan Lin et al. (+1 more)
Differentially private (DP) image synthesis generates images that preserve the statistical characteristics of a sensitive
dataset, enabling sensitive data analysis and usage while providing rigorous guarantees of
privacy leakage. Existing methods fine-tune public models using DP
Stochastic Gradient Descent (DP-SGD) on sensitive images to generate synthetic images. But full fine-tuning public models on sensitive images is computationally expensive, because current public models typically contain a large number of parameters. Recent work proposes heuristically using Low-Rank Adaptation (LoRA) on all
attention-layer parameters of public models to reduce the number of trainable parameters. However, we argue that exhaustive LoRA coverage across all
attention-layer parameters is suboptimal in a DP setting, as it leads to noise accumulation and collapse during private training. To address this issue, we propose DP-SAPF, which uses a saliency-aware strategy to identify specific target parameters for LoRA training under DP. DP-SAPF is inspired by the fact that larger gradients signify higher saliency, indicating that these parameters are most critical for the DP learning. Specifically, we feed the sensitive images into public models, compute gradients, and add noise to the gradients to satisfy DP. Then, DP-SAPF identifies the most salient parameters, those exhibiting high gradient magnitudes on sensitive images, for DP fine-tuning. Experiments on four sensitive image
datasets show that DP-SAPF improves the utility and fidelity of synthetic images while requiring fewer computational resources than fine-tuning methods without parameter selection.
Read the full abstract ▾
All authors Chen Gong, Kecen Li, Zinan Lin, Tianhao Wang
Cryptography and Security
bpK#: Delegatable Pseudonyms And Their Applications to National eID Systems
Stephan Krenn, Doryan Lesaignoux and Sebastian Ramacher
Electronic identities (eIDs) are crucial in an increasingly digitalized environment. Pseudonyms, as offered by Austria's governmental sector-specific personal identifiers (bPks), can significantly improve
privacy by ensuring that personal data is not universally traceable across public services and private companies. However, the current architecture comes with several challenges regarding availability,
privacy, and authenticity, due to a fully centralized design. This paper proposes bPk#, a distributed architecture to address these issues, reducing reliance on the central authority, while still providing all functional requirements to the existing bPk system. In particular, users are delegated the rights to compute their own pseudonyms, thereby minimizing metadata revealed to the central authority, while (subsets of) service providers may receive the right to compute pseudonyms only within their own domain, thereby reducing the availability needs of the central authority. To the best of our knowledge, we provide the first formal framework for such delegatable pseudonym systems, together with a generic construction for which we provide formal security proofs. Furthermore, we propose a concrete instantiation of our construction, together with a reference implementation demonstrating the practical efficiency.
Read the full abstract ▾
Cryptography and Security
A Bayesian Approach to Membership Inference for Statistical Release
Lisa Oakley, Sam Stites, Cameron Moy et al. (+3 more)
The membership inference problem for publicly released statistics from a private
dataset is well-studied. When developing and formally analyzing attack strategies, however, the focus has been on attacks that model the population using only its marginals. In practice, these attacks can perform well on various populations, however most formal analysis is for populations that follow a product distribution. These strategies may fail to leverage useful information about the population that is important for understanding a realistic
privacy threat. In this work, we explore the impact of providing an attacker with additional information about the attribute dependency structure of the population, motivated by examples where multiple parties may have access to similarly structured data, for example the US Census and the IRS. To model this scenario, we re-frame the membership inference problem with respect to a population represented as a
Bayesian network (BN). We develop a framework based on
Bayesian decision-making which can incorporate prior information about the population to launch more effective, specialized attacks. To evaluate our framework, we introduce a specific attack instantiation which computes the
Bayesian posterior using a probabilistic program, and prove its equivalence to an optimal variant of the likelihood ratio test attack for two populations with strong attribute dependency. We implement our program in the Roulette probabilistic programming
language and show experimentally that it outperforms the likelihood ratio test and inner product attacks on five commonly used BNs, where the population dependency structure is too complex for the existing attacks to be manually adapted.
Read the full abstract ▾
All authors Lisa Oakley, Sam Stites, Cameron Moy, Steven Holtzen, Alina Oprea, Marco Gaboardi
Cryptography and Security
Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection
Travis Lelle
We show that LoRA adapters, the dominant distribution format for fine-tuned LLMs, can be reliably backdoored through training data poisoning while preserving baseline task performance. On a Qwen 2.5 1.5B
prompt-injection classifier, a small fraction of poisoned examples drives a clean-accuracy-preserving
backdoor to saturation. The resulting
backdoor generalizes at the
token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC reference but does not transfer to structurally identical ISO, OWASP, CWE, or NIST citations. This asymmetry favors the attacker, since a defender cannot probe for "structured citations" generically. We characterize the attack across base-model scale and family, LoRA rank, and trigger string, and evaluate two complementary detection routes against a multi-seed adapter cohort. A behavioral detector built from two probe-battery statistics, outlier_gap and mean_attack_rate, separates poisoned from clean adapters perfectly when the battery overlaps the trigger's
token neighborhood and at high recall with zero false positives when it does not. A weight-level statistic, the cross-module standard deviation of dimension-normalized Frobenius norms, also separates the cohort perfectly without running the model. Combined, the two routes are robust to probe composition. Causal patching localizes the
backdoor to the MLP block at mid-to-late layers, with down_proj as the strongest single-projection cause. Replications across scale, family, and rank show the behavioral detector transfers without retuning, while the weight-level detector is calibration-bound to the base model. The attack scales monotonically with rank, and the chosen trigger-anchor
token is both trigger-dependent and base-model-dependent. Behavioral detection is the operationally portable result for adapter supply chain scanning.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.AI
BioRefusalAudit: Auditing Biosecurity Refusal Depth Using General and Domain-Fine-Tuned Sparse Autoencoders
Caleb DeLeeuw
Biosecurity evaluations of
language models typically ask whether models produce hazardous output. This paper asks a complementary question: when a model refuses, is that refusal structurally sound, or does it disappear under modest changes to
prompt framing, formatting, or output length? Across five architectures, no model cleanly discriminated benign from hazard. Gemma 2 2B-IT never genuinely refused across 75
prompts, hedging on every hazard-adjacent query. Gemma 4 E2B-IT refused 65/75
prompts with chat-template formatting and 0/75 without it. Both Gemma models collapsed to 0% under an 80-
token cap. Qwen 2.5 1.5B and Phi-3-mini over-refused, flagging 83-87% of benign biology as hazardous. Llama 3.2 1B showed the only meaningful tier gradient (61-point spread). To probe what drives such over-refusal, we tested a panel of Schedule I but biologically non-toxic compounds (notably psilocybin cultivation, with FDA Breakthrough Therapy status). Some models refused these at rates exceeding genuinely hazardous biology, suggesting refusal tracks legality and cultural salience over CBRN hazard. To measure the internal side, we introduce a divergence score D comparing a model's surface response label to its internal sparse autoencoder (SAE) feature activations. Full D was computed on Gemma 2 2B-IT (Gemma Scope 1) and Gemma 4 E2B-IT (author-trained bio SAE). Two fine-tuned Gemma 2 domain SAEs were released. On Gemma 4, comply and refuse responses separated by a 0.647-point gap with zero overlap (n=75), though this is preliminary, with a narrow catalog, within-sample calibration, and Gemma-family-only SAE coverage. Built over one hackathon weekend on consumer hardware (GTX 1650 Ti Max-Q, plus Colab T4 for SAE training), this preliminary evidence suggests activation-level
auditing may surface failure modes invisible to behavioral evaluation, with substantial variation across architectures.
Read the full abstract ▾
Cryptography and Security
Privacy-Enhanced Zero-Order Federated Learning via xMK-CKKS over Wireless Channels
Anthony Ayli, Khalil Harris, Jihad Fahs et al. (+1 more)
Homomorphic encryption (HE) enables
privacy-preserving aggregation in
federated learning (FL) by allowing the server to operate on encrypted data without decryption. Existing HE-over-the-air (OTA) methods mainly rely on single-key HE schemes and require channel estimation or pre-equalization to compensate for wireless fading. However, single-key HE remains vulnerable to honest-but-curious (HBC) clients holding the shared secret key, while multi-key HE provides stronger client-level security by assigning each device its own secret key. We propose a four-phase protocol that enables the aggregation of xMK-CKKS over a shared wireless channel without channel estimation. The protocol retransmits partial public keys and ciphertexts through the same channel realization, so that the dominant large-modulus encryption terms cancel algebraically during decryption. We integrate this protocol with zero-order FL over slowly varying LoS-dominant channels, where each device transmits a single encrypted scalar per round and the communication/encryption overhead is independent of the model dimension. We show that the residual noise induced by encryption and wireless aggregation preserves the standard convergence rate \(O(1/\sqrt{K})\) up to a negligible noise floor, where $K$ is the number of communication rounds. The protocol assumes a non-trusted server and is secure against HBC clients, preventing any client from recovering the local updates of other participants. Numerical results on MNIST and CIFAR-10 validate the theoretical analysis.
Read the full abstract ▾
All authors Anthony Ayli, Khalil Harris, Jihad Fahs, Mohamad Assaad
Cryptography and Security
How Reliable Are AI Attackers Against a Fixed Vulnerable Target? A 400-Run Empirical Study of LLM Penetration Testing Consistency
Galip Tolga Erdem
Large
language models (LLMs) can autonomously conduct multi-stage cyber attacks, but the consistency of their offensive behavior under repeated trials remains unstudied. This work presents the first large-scale empirical measurement of LLM attack consistency: 400 autonomous penetration testing runs (4 models, 100 each) against an identical honeypot hosting OWASP Juice Shop and two additional vulnerable services, holding
prompt, orchestrator, and target constant. No model emitted a content refusal that survived the orchestrator's one-shot authorization re-
prompt at iterations 0-1. Claude Sonnet 4's API calls did encounter upstream service unavailability - 91 of 1,135 calls returned HTTP 529 overloaded_error during a documented Anthropic capacity event, truncating 39 of 100 Claude runs. An earlier draft catalogued these as safety refusals; on full-log audit they are upstream API failures, not model-level refusals. Despite this, Claude achieved full exploitation in 61 of 100 runs; Gemini 2.5 Flash-Lite in 85; GPT-4o-mini in 56 while deploying 98 unique attack strategies; qwen2.5-coder:14b in 25. Failure modes are model-distinctive: Claude through API truncation (39 runs), qwen through premature completion (52), GPT-4o-mini through iteration-budget exhaustion (23). Cross-service credential reuse appeared only in configurations retaining the most conversation history (qwen 57%, GPT-4o-mini 49%, cloud models 0% on 5-exchange windows). Cross-model exploitation rate differences are statistically significant (p < 0.001) with large effect sizes; qwen vs. Gemini SQL injection rates differ at Cohen's h = 1.12. First-exploit timing fell within a 15-30 second wall-clock range. To our knowledge, this is the first study to measure autonomous LLM attack behavior at N=100 per model across a multi-service target.
Read the full abstract ▾
Cryptography and Security
Token Inflation: How Dishonest Providers Can Overcharge for Large Language Model Usage
Shahinul Hoque, Jinghuai Zhang, Jinyuan Sun et al. (+1 more)
Per-
token billing is now the standard pricing model for commercial large
language models (LLMs), so the honesty of reported
token counts directly affects what users pay. We show that this kind of billing is hard to audit by design: providers hide the model, the tokenizer, and the execution to protect their IP, mitigate jailbreaks, and preserve user
privacy, which means an auditor can only inspect proofs the provider supplies. The audit therefore reduces to a consistency check on the provider's own reports. We call this a trust paradox: every audit must trust some artifact, but current frameworks trust exactly the ones a provider has the strongest reason to manipulate. We study three recent
token auditing frameworks and show that a provider with ordinary commercial capabilities can systematically inflate billed
token counts. In the most permissive setting, hidden
reasoning usage can be inflated by 1,469% on average without detection. At current frontier
reasoning prices, that turns a \$100 honest bill into roughly a \$1,569 bill on the same query. Even when the user can see the full
reasoning string, tokenization ambiguity alone still allows 50.85% over-reporting below the detection threshold. These results suggest the problem is not in any specific auditor but in any audit whose evidence comes from the audited party. Restoring honest billing will require verification that ties reported
token counts to evidence the provider does not control, such as trusted execution attestation, cryptographic proofs of inference, or third-party re-execution.
Read the full abstract ▾
All authors Shahinul Hoque, Jinghuai Zhang, Jinyuan Sun, Fnu Suya
Cryptography and Security
Fingerprinting Inference Systems of Large Language Models
Anna Wimbauer, Jonas Möller, Erik Imgrund et al. (+1 more)
The behavior of LLMs does not depend solely on the model itself. Components of the inference system, such as the inference engine,
attention backend, and hardware platform, subtly influence how inputs are processed. These components differ in their implementations and thereby induce small numerical deviations across systems when running the same model. While prior work has established the theoretical existence of such deviations, their security implications have remained unexplored. In this paper, we show that these deviations are characteristic of specific components and propagate to observable textual outputs, exposing the inference system to any party that can query the model. Building on this observation, we introduce a fingerprinting method that analyzes the
prompt-response behavior of LLMs to identify components of the inference system. Our empirical evaluation demonstrates that the inference engine,
attention backend, and underlying hardware platform can be identified reliably, even when the LLM is operated at non-zero temperature. We show that preventing fingerprinting is fundamentally hard, as it would require eliminating numerical differences between hardware and software stacks. We therefore propose partial mitigations and discuss their impact.
Read the full abstract ▾
All authors Anna Wimbauer, Jonas Möller, Erik Imgrund, Konrad Rieck
Cryptography and Security
Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots
Mark Vero, Fabian Kaczmarczyck, Ivan Petrov et al. (+6 more)
Honeypots are decoy systems mimicking real system components designed to defend against cyber attacks. Recently, LLMs increasingly serve as simulation backbones for honeypots. They enable defenders to construct high-interaction honeypots with low system security risks. However, LLM-powered honeypot development lacks a unified evaluation framework. Most evaluations consist of measuring response similarity on fixed commands, manual testing, or real-world deployment. These methods are often not scalable for development, reproducible across evaluations, representative of practical attacks, or adaptable to various attacker and honeypot configurations. In this work, we bridge this gap and propose Honeyval, a comprehensive evaluation framework for LLM-powered HTTP honeypots. We address the limitations of prior evaluations by grounding the honeypots in 16 backend applications, using AI hacking
agents as attackers, employing two control tasks to monitor
agent and honeypot capabilities across customizations, and defining clear and verifiable exploit goals for the attacker. Using Honeyval, we conduct an extensive evaluation of recent cost-efficient LLMs as HTTP honeypots. Our experiments highlight the promise of LLM-powered honeypots; they lead to substantially longer interactions with the attacker than rule-based baseline honeypots and are far less frequently detected even by frontier models, all while, on average, preserving a running cost advantage against agentic attackers. Further, we experiment with different counter-offensive honeypots configurations, and observe unique trade-offs, such as longer interactions at the cost of increased detection.
Read the full abstract ▾
All authors Mark Vero, Fabian Kaczmarczyck, Ivan Petrov, Ilia Shumailov, Jamie Hayes, Niels Heinen, Tianqi Fan, Luca Invernizzi, Martin Vechev
Cryptography and Security
MemPoison: Bypassing Selective Memory Mechanisms to Plant Backdoors in LLM Agents
Hongtao Wang, Se Yang, Yu Chen et al. (+1 more)
Large
language model (LLM)
agents increasingly leverage long-term
memory to support persistent and autonomous task execution. However, this capability also introduces a new attack surface:
memory poisoning, where adversaries can inject malicious information to influence future behavior. Existing
memory poisoning attacks often assume that injected content can be stored directly in
memory, overlooking the selective extraction and rewriting stages in modern
memory pipelines. This makes prior methods ineffective under realistic settings. In this paper, we propose MemPoison, a novel
memory poisoning attack that bypasses selective
memory mechanisms in LLM
agents, where an attacker can inject triggerable
backdoors into the
agent's long-term
memory through dialogue interactions, thereby misleading its subsequent responses. MemPoison introduces three key components: (i) a semantic relational bridge that binds the trigger and payload into a coherent statement to ensure their co-extraction into
memory; (ii) entity masquerading that optimizes triggers to mimic named entities, resisting rewriting; and (iii) joint
embedding optimization that shapes trigger-injected texts into a tight cluster in the
embedding space while maintaining isolation from benign
embeddings for stealth. Evaluations across different
agent domains and
memory mechanisms show MemPoison achieves attack success rates up to 0.95, outperforming existing baselines. Mechanistic analysis reveals the exploitation of
embedding-space anisotropy and
attention redistribution, highlighting core vulnerabilities in selective
memory systems. We evaluate multiple defense strategies and demonstrate their fundamental limitations in mitigating the attack. We release our code to facilitate further research.
Read the full abstract ▾
All authors Hongtao Wang, Se Yang, Yu Chen, Puzhuo Liu
Cryptography and Security
Dissecting the Black Box: Circuit-Level Analysis of LLM Vulnerability Detection
Syafiq Al Atiiq, Chun Zhou and Christian Gehrmann
Large
language models (LLMs) can detect software vulnerabilities, but how do they actually identify vulnerable code? We address this question using mechanistic interpretability; analyzing the internal computations of a neural network to understand its
reasoning process.Using
Circuit Tracer on Gemma-2-2b, we trace the computational pathways activated when the model classifies 472 C/C++ code samples as vulnerable or safe. Our analysis reveals a surprising finding: the model primarily relies on safety detectors,
attention heads that recognize safe coding patterns, rather than directly detecting vulnerability signatures. When these safety detectors fail to activate, the model classifies code as vulnerable. We identify the critical neural components: specific
attention heads in early layers (L5, L7) that focus on safety patterns, and Multilayer Perceptron (MLP)
neurons in Layer 7 that encode vulnerability-related features. Ablation experiments confirm their causal role; removing Layer 11 drops vulnerability detection accuracy from 100% to 6%, while ablating just 20
neurons in Layer 7 reduces it by 50%.Our findings show that LLM vulnerability detection uses sparse, interpretable
circuits (only 16% of model capacity), enabling
circuit-level explanations for security predictions and targeted improvements to detection systems.
Read the full abstract ▾
Cryptography and Security
Ciphera: A Decentralised Biometric Identity Framework
Ankit Kanaiyalal Prajapati, Shahzad Memon, Mohammed Mahir Rahman et al. (+1 more)
Centralised biometric identity systems expose users to single points of failure, opaque verification processes, and irreversible biometric compromise. Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) offer stronger
privacy guarantees, yet their integration with biometric authentication and distributed verification remains insufficiently explored. This paper presents Ciphera, a decentralised biometric identity framework combining
privacy-preserving facial recognition, multi-node verification, IPFS-based credential metadata storage, and blockchain-anchored revocation. Evaluated across functional, performance, security, and distributed consistency dimensions, Ciphera achieved an 81% functional success rate, with stable enrolment and authentication but measurable revocation propagation delays and occasional audit-log inconsistencies. Performance testing demonstrated sub-second p95 verification latency of approximately 820ms under concurrent multi-node conditions. Security analysis confirmed strong confidentiality and integrity guarantees, though incomplete liveness detection leaves susceptibility to deepfake and replay attacks. The results demonstrate the feasibility of decentralised biometric identity while identifying key engineering challenges for production-grade deployment.
Read the full abstract ▾
All authors Ankit Kanaiyalal Prajapati, Shahzad Memon, Mohammed Mahir Rahman, Ameer Al-Nemrat
Cryptography and Security
Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing
Leyi Qi, Yiming Li, Siyuan Liang et al. (+2 more)
Large-scale text-to-image (T2I)
diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing
backdoor-based
diffusion watermarking methods often (implicitly) assume a "faithful" verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert-LAS, the first certified MOV method for T2I models based on layer-adaptive smoothing. In general, Cert-LAS embeds specified watermarks using
diffusion classifiers and an LFS-guided layer-adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert-LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert-LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi-Qi/Cert-LAS.
Read the full abstract ▾
All authors Leyi Qi, Yiming Li, Siyuan Liang, Zhengzhong Tu, Dacheng Tao
Cryptography and Security · Cross-listed from cs.AI
AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security
Dongrui Liu, Yu Li, Zhonghao Yang et al. (+47 more)
Modern open-world
agents such as OpenClaw exhibit powerful cross-environment execution capabilities yet introduce broad new safety risk sources. Meanwhile, advanced frontier AI models drastically lower attack barriers, rendering current
agent alignment frameworks inadequate for real-world deployment. To tackle these emerging threats, we propose a lightweight and scalable
agent safety
alignment framework. Specifically, we update the
agent safety taxonomy to accommodate emergent risks from Codex and OpenClaw execution scenarios. We further build a taxonomy-guided data engine with influence-function purification to train lightweight AgentDoG 1.5 variants (0.8B, 2B, 4B, and 8B parameters) using only around 1k samples, achieving comparable performance with leading closed-source models (e.g., GPT-5.4). Based on AgentDoG 1.5, we construct a highly efficient agentic safety SFT and RL training environment, which reduces deployment overhead in Docker-level environments by two orders of magnitude. Finally, we deploy AgentDoG 1.5 as a training-free online guardrail for real-time safety moderation. Extensive experimental results indicate that AgentDoG 1.5 achieves state-of-the-art performance in diverse and complex interactive agentic scenarios. All models and
datasets are openly released.
Read the full abstract ▾
All authors Dongrui Liu, Yu Li, Zhonghao Yang, Peng Wang, Guanxu Chen, Yuejin Xie, Qinghua Mao, Wanying Qu, Yanxu Zhu, Tianyi Zhou, Leitao Yuan, Zhijie Zheng, Qihao Lin, Yimin Wang, Haoyu Luo, Shuai Shao, Chen Qian, Qingyu Liu, Ling Tang, Ruiyang Qin, Qihan Ren, Junxiao Yang, Kun Wang, Zhiheng Xi, Linfeng Zhang, Ranjie Duan, Bo Zhang, Wenjie Wang, Wen Shen, Qiaosheng Zhang, Yan Teng, Chaochao Lu, Rui Mei, Man Li, Jialing Tao, Xi Lin, Tianhang Zheng, Yong Liu, Quanshi Zhang, Lei Zhu, Xingjun Ma, Junhua Liu, Hui Xue, Xiaoxiang Zuo, Xiangnan He, Chao Shen, Xianglong Liu, Minlie Huang, Jing Shao, Xia Hu
Cryptography and Security · Cross-listed from cs.IT
Secure Distributed Hypothesis Testing
Gowtham R. Kurri, Varun Narayanan, Vinod M. Prabhakaran et al. (+1 more)
In distributed hypothesis testing, a central server performs hypothesis testing based on information received from distributed sensors/clients. We study a secure variant of this problem in which the central server determines the hypothesis class of an underlying distribution without learning any additional information about the distribution itself. We prove that, in its standard form, this is impossible to achieve, even for simple and highly restricted cases. To bypass this impossibility, we augment the model with a shared secret key available to clients but hidden from the server. We show that a single-bit secret key enables perfectly secure testing for simple classes by reducing the test distributions to a symmetric, canonical instance. Finally, for arbitrary hypothesis classes over finite domains, we establish a reduction to standard hypothesis testing using Private Simultaneous Messages (PSM) protocols, achieving
polynomial communication and key lengths.
Read the full abstract ▾
All authors Gowtham R. Kurri, Varun Narayanan, Vinod M. Prabhakaran, K. R. Sahasranand
Cryptography and Security
Minimal Prompt Perturbations Lead to Code Vulnerabilities: Prompt Fragility and Hidden-State Signals in Coding LLMs
Alexander Sternfeld, Andrei Kucharavy and Ljiljana Dolamic
LLM-based coding assistants are seeing rapid adoption, offering substantial gains in developer productivity. As organizations increasingly ship code these
agents produce, the security of that code becomes critical. Prior work has shown that minor
prompt perturbations degrade the functional correctness of LLM-generated code, but whether they also compromise code security has remained unstudied. We apply
token-level mutations to
prompts across three models and five programming
languages, and show that mutations as small as a single-character change can flip generated code from secure to vulnerable. Probing the models' hidden states reveals that this fragility is partially encoded in
prompt representations, but unevenly so. Input-handling vulnerabilities, where the model omits validation or sanitization, are more predictable (mean AUC 0.753) than secure-defaults vulnerabilities, where insecure code stems from one local choice such as a weak
algorithm or unsafe parameter (mean AUC 0.674). These results show that the threat model for LLM-assisted coding extends beyond
prompt injection to ordinary
prompt variation, and indicate that input-handling flaws can be caught before generation while secure-defaults flaws require intervention during decoding.
Read the full abstract ▾
Cryptography and Security
FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices
Alessandro Lotto, Savio Sciancalepore, Alessandro Brighente et al. (+1 more)
The Manufacturer Usage Description (MUD) enables enforcement of network restrictions for IoT devices based on their expected network traffic, as specified by manufacturers in a MUD file. Devices advertise a URL pointing to this file, yet the standard does not define how to securely bind the issuing device to its profile. As a result, malicious devices can manipulate network policy enforcement by advertising valid URLs referencing genuine MUD profiles, but not intended for that device. Although MUD defines a certificate-based secure issuance method, current deployments rely on the insecure DHCP-based extension due to simpler integration. Existing solutions either depend on Public Key Infrastructure (PKI), break standard compliance, require excessive active manufacturer involvement, or overlook secure profile updates. In this paper, we present FIDEM, a standard-compliant framework for securing DHCP-based MUD URL issuance. FIDEM provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication, without requiring device certificates or device-side PKI, minimizing manufacturers' involvement, and supporting secure profile updates. Formal analysis shows that FIDEM withstands stronger adversaries than in prior work, including supply-chain compromise and attacks using legitimate devices as cryptographic oracles. Our real-world evaluation on two reference constrained devices (ESP32-S3 and ESP32-C6) demonstrates minimal overhead compared to standard DHCP (~5 ms, 20 mJ) and significant improvements over certificate-based
benchmarks (x21 faster, ~23%\) less energy consumption) on an ESP32-C6 device.
Read the full abstract ▾
All authors Alessandro Lotto, Savio Sciancalepore, Alessandro Brighente, Mauro Conti
Cryptography and Security
Scarcity Is Not Enough: Structural Limits of Linear Sybil Cost Under Parallelizable Resources
Homayoun Maleki, Nekane Sainz, Jon Legarda et al. (+1 more)
Permissionless systems resist Sybil attacks by binding influence to scarce resources. Yet influence concentration persists across systems built on computation, capital, and other reusable resources despite substantial differences in protocol design. This raises a fundamental question: is concentration primarily a consequence of protocol rules, or of the structural properties of the underlying resource itself? We address this through the
adversarial cost function $C(s,T)$, the minimum expenditure to sustain influence equivalent to controlling $s$ independent participants over a horizon of length $T$. We develop an axiomatic resource taxonomy connecting resource structure to
adversarial cost scaling. We show that resource-mechanism pairs satisfying divisibility, additivity of influence, temporal reusability, and identity transferability admit influence amortization, yielding $C(s,T)=o(sT)$. Conversely, throughput-bounded, non-transferable, window-local resources enforce $C(s,T)=\Omega(sT)$, with marginal cost $\Delta(s,T)=\Omega(T)$ increasing with time. These results reveal a fundamental asymptotic separation between resource classes that admit amortization and those that enforce linear cost. These results shift the focus of decentralization from protocol design to resource design. If concentration is a structural consequence of the properties that make resources parallelizable, redesigning consensus rules alone cannot eliminate it. The same properties enable concentrated control to be projected across many nominally distinct participants through delegation, pooling, or identity replication, obscuring the relationship between visible identities and underlying control. The search for stronger decentralization must therefore begin with the choice of the underlying resource.
Read the full abstract ▾
All authors Homayoun Maleki, Nekane Sainz, Jon Legarda, Igor Santos-Grueiro
Cryptography and Security · Cross-listed from cs.CY
Information Security in Small-Scale Protests: Surveillance of Ugandan Anti-EACOP Protesters
Ntezi Mbabazi and Rikke Bjerg Jensen
We examine the information security practices of Ugandan
climate activists protesting the development of the East African Crude Oil Pipeline (EACOP). We conducted five-week fieldwork in Kampala, Uganda, which included interviews with 13 anti-EACOP activists. Through an inductive analysis, we report on the complexities faced by small groups of predominantly student protesters as they covertly organise small-scale anti-EACOP protests within a context marked by state surveillance and repression. Our study points to a multi-layered
adversarial landscape, where participants' experiences of direct threats, including arrests and information compromise, and their fears of abduction, shaped their security practices. These practices were rooted in autonomous decision-making within groups. We present a grounded understanding of how participants' need to protect information for their own security, as well as that of others, permeated their lives, leading them to adjust day-to-day aspects of their device management, communication, accommodation, transport and social relations as deliberate tactics to mitigate surveillance.
Read the full abstract ▾
Cryptography and Security
Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution
Oleksandr Mostovyi
Control Flow Graphs are one of the main data sources for software analysis that use dynamic and static software analysis methods. Protected software and modern malware increasingly depend on dynamic code loading techniques to evade static analysis. Usage of runtime dynamic linking mechanisms introduces unresolved indirect calls that stop static Control Flow Graph recovery. This serves to hide dynamic library that can be used for prevention of security analysis. To address this limitation, an analysis technique is proposed that combines symbolic execution with speculative library preloading to recover Control Flow Graphs from binaries by using dynamic loading. The methodology uses custom software hooks that intercept dynamic loading operations during symbolic execution and perform actual library loading into the analysis state. The module is based on a two-level architecture that stores interception functions and instruction tracking at the same time, all within a symbolic execution environment. To avoid executing potentially malicious code that dynamic instrumentation tools require, the analysis was conducted entirely through symbolic execution, making it safe for malware analysis. For evaluation a batch of 16 synthetic
benchmarks was used, employing various obfuscation techniques including encrypted library names, network-triggered loading, environment-derived paths, multi-stage decryption chains, fileless execution and manual executable and linkable format parsing. The experiments results show that module recovers on average 29.8 % additional Control Flow Graph nodes and 26.5 % additional edges compared to static analysis alone, achieves 100 % precision and 100 % recall in library detection, with all discoveries validated through Frida-based dynamic instrumentation.
Read the full abstract ▾
Cryptography and Security
LoRA-Key: User-Centric LoRA Watermarking for Text-to-Image Diffusion Models
Yaopeng Wang, Qingliang Wang, Zhibo Wang et al. (+5 more)
Low-Rank Adaptation (LoRA) has become a widely used mechanism for customizing text-to-image
diffusion models, enabling lightweight modules that are shared, reused, and commercialized as independent assets. This LoRA-centric ecosystem shifts copyright protection from foundation models to distributed LoRA modules, which are easy to copy, redistribute, or reuse without authorization. Existing watermarking methods either protect the base
diffusion model or require watermark-aware retraining for each target LoRA, limiting their practicality in open community settings. To address this limitation, we propose LoRA-Key, a user-centric LoRA watermarking framework that treats copyright protection as a reusable ownership key. LoRA-Key encapsulates a recoverable secret message into a standalone user-specific Watermark LoRA, which can be attached to different target LoRAs through training-free linear superposition without per-LoRA retraining or structural modification. To train such a reusable key, we first establish a latent watermark prior in the frozen VAE latent space for robust message
embedding and recovery, and then optimize the Watermark LoRA with message-conditioned watermark supervision and semantic consistency constraints. We further introduce Gradient Orthogonal Projection (GOP) to suppress watermark updates that conflict with semantic-preserving directions, reducing interference with generation fidelity and downstream style adaptation. Extensive experiments show that LoRA-Key provides lightweight plug-and-play copyright protection while preserving generation quality and style fidelity, and maintains robust ownership verification under image-level distortions, downstream fine-tuning, and multi-LoRA composition.
Read the full abstract ▾
All authors Yaopeng Wang, Qingliang Wang, Zhibo Wang, Huiyu Xu, Jiacheng Du, Qiu Wang, Jia-Li Yin, Kui Ren
Cryptography and Security
Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection
Runang He, Tongya Zheng, Huiling Peng et al. (+6 more)
Ever-evolving transaction patterns have significantly hindered anomaly detection on emerging cryptocurrency blockchains due to the vast number of addresses and diverse anomalous behaviors. Recently, advanced Graph Anomaly Detection (GAD) approaches applied to blockchains have faced two critical challenges:
adversarial pattern
evolution by malicious actors and the out-of-distribution (OOD) problem caused by varied transaction semantics on blockchains. To address these challenges, we propose a novel framework termed TEmporal Motif-aware Graph Test-Time Adaptation (TEMG-TTA). First, we comprehensively capture the 3-node temporal motif distribution of each active address using an efficient computational mechanism, enabling downstream temporal motif-aware graph learning. Second, we design a simple yet effective test-time adaptation strategy to facilitate the sharing of common patterns between training and testing graphs. Extensive experiments on 5 real-world
datasets demonstrate that our proposed TEMG-TTA outperforms state-of-the-art GAD approaches by an average of 54.88%. A further case study on interpretable motif patterns reveals that TEMG-TTA explicitly characterizes the complex transaction patterns of anomalous addresses, thereby verifying the effectiveness of our technical designs. Our code is publicly available at https://github.com/LuoXishuang0712/TEMG-TTA/.
Read the full abstract ▾
All authors Runang He, Tongya Zheng, Huiling Peng, Yuanyu Wan, Bingde Hu, Jiawei Chen, Canghong Jin, Mingli Song, Can Wang
Cryptography and Security
KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing
Yijia Fang, Yiqing Feng, Bingyu Li et al. (+1 more)
Relay and reseller APIs mediate access to large
language models (LLMs), but users cannot directly verify which model serves them. We introduce \name, a black-box
auditing protocol based on stable factual recall near the knowledge boundary, including repeatable wrong answers. KBF generates benign, renewable probes and calibrates audit decisions against reference self-variation. Across 16 production endpoints, KBF detects all 155 economically relevant substitutions without rejecting any of the 16 same-reference controls. KBF remains robust to deployment variation and reaches 95% TPR at a substitution rate as low as 15% in mixed-routing simulations. Field audits flag 7 of 28 endpoints across six platforms as statistically inconsistent with their references. After reference enrollment, even GPT-6 Astra costs only approximately \$0.67 per online audit at the recorded API prices.
Read the full abstract ▾
All authors Yijia Fang, Yiqing Feng, Bingyu Li, Mingxun Zhou
Cryptography and Security · Cross-listed from cs.SE
CODEFUSE-DEBENCH: An Empirical Study on Readability, Recompilability, and Functionality
Puzhuo Liu, Yuhan Huang, Jianlei Chi et al. (+2 more)
Binary decompilation aims to recover binaries into high-level source code, but existing evaluations mainly rely on syntactic similarity or single-axis readability metrics, which fail to capture practical reusability. We propose a reusability-driven evaluation paradigm that measures decompiler quality along three orthogonal dimensions: readability, recompilability, and functionality. We present DEBENCH, the first automated framework for multidimensional decompilation evaluation. DEBENCH contains 240 atomic test functions, organized into 8 source files and compiled into 640 binaries. It combines LLM-as-judge readability scoring with URAF (18 sub-dimensions), iterative compile-and-repair under a fixed 50-iteration budget, and Frida-based differential dynamic tracing at the program, function, and instruction levels. We evaluate five mainstream decompilers and three repair LLMs. Our study reveals four findings. First, the reusability cliff is steep: the best decompiler-LLM pair reaches 22.3% Exact+Partial program-level behavioral overlap but only 1.2% exact stdout match, nearly 50 points below recompilability. Second, settings that maximize readability do not maximize functionality: -O3 yields the lowest readability but the highest functionality, and Clang gives lower readability than GCC but 2.6x higher functionality. Third, cross-decompiler variation at the functional level is 20x, far larger than the 1.6x cross-LLM variation, showing that progress depends more on decompiler engines than larger repair models. Fourth, failures fall into three categories: syntactic noise, type-system collapse (about 19% of repair errors), and irreversible upstream losses such as ARM64 relocation idioms and C++ ABI features.
Read the full abstract ▾
All authors Puzhuo Liu, Yuhan Huang, Jianlei Chi, Peng Di, Yu Jiang
Cryptography and Security
SciIntBench: Measuring LLM Compliance with Research Integrity Norms Under Adversarial Framing
Almene De Meran Meguimtsop, Maria Leonor Pacheco and Daniel E. Acuna
Large
language models (LLMs) are increasingly used to support scientific work, but it is unclear whether they uphold responsible conduct of research (RCR) norms or help undermine them. We introduce SciIntBench, an
adversarial benchmark of 1350
prompts across 270 scenarios, ten RCR categories, and three scientific domains. Each scenario appears in five gradations, from Most Overt to Most Covert
adversarial prompts, and an additional Benign version, allowing us to jointly measure framing-sensitive refusal of misconduct and helpfulness on legitimate requests. We evaluate 16 commercial and open-weight LLMs from six providers (2024–2026), producing 21,600 responses. We assess the responses using LLM judgments validated by human evaluation, achieving high agreement ($\kappa$ = 0.857). We find that, under the most covert framing condition, models fail to refuse requests for research misconduct in 71.7% of cases, on average. Refusals vary by RCR category, with weaker boundaries around transparency, plagiarism, and fabrication.
Read the full abstract ▾
Cryptography and Security
Bridging Theory and Practice: An Executable Taxonomy of Security Properties for ProVerif and Tamarin
Leonard Tudorache, Ivan Kurtev and Mark van den Brand
Security is critical for everything relying on modern digital systems. Because almost all digital interactions are governed by the Internet and cryptographic protocols, these protocols must serve as reliable mechanisms that guarantee core security properties, such as confidentiality and integrity. Formal verification of these protocols is a critical step in securing interconnected systems. Tools such as ProVerif and Tamarin are widely employed to perform automated verification. However, their effective use demands specialized domain knowledge, creating a significant learning curve for security protocol designers who often have a security, rather than a formal verification background. We therefore need structured, accessible resources to help protocol designers to express their design and requirements in the
language of the formal verification tools. To address this, we introduce a systematic and evidence-based taxonomy of security properties. This taxonomy is derived from a literature review of 53 recent studies (2022-2025) that used ProVerif and Tamarin, providing an up-to-date view of verified properties. We systematically categorize and define these properties, providing both informal definitions for intuitive comprehension and rigorous formal definitions expressed in first-order logic for clarity and consistency. We further detail modeling patterns and implement executable examples in both ProVerif and Tamarin, collected in an open repository. This work advances the state of the art by bridging the gap between theoretical security property definitions and their practical, executable verification models.
Read the full abstract ▾