Cryptography and Security
BadBone: Backdoor Attacks Against Backbone Models in Visual Prompt Learning
Ziqing Yang, Rui Wen, Xinlei He et al. (+3 more)
Prompt learning is a new machine learning paradigm that has attracted ample
attention due to its simplicity and proven efficacy. Despite its growing adoption, the security vulnerabilities associated with this paradigm remain underexplored. In this work, we take the first step to propose BadBone, a stealthy and adaptive
backdoor attack against
prompt learning using bi-level optimization. Instead of backdooring the
prompt learning process, we aim to compromise a backbone model such that only target downstream tasks employing
prompt learning inherit the
backdoor vulnerability. Extensive experiments on three different models and three
datasets from various domains show that our targeted/untargeted backdoored models achieve high attack performance while maintaining utility on both pre-training and downstream tasks. Moreover, we evaluate our approach against six state-of-the-art model-level defenses, including Neural Cleanse, ABS, MNTD, NAD, CLP, and D-BR. The results demonstrate that these defenses are largely ineffective against our backdoored models and thus leave the effective defense as an important direction for future work.
Read the full abstract ▾
All authors Ziqing Yang, Rui Wen, Xinlei He, Yun Shen, Michael Backes, Yang Zhang
Cryptography and Security · Cross-listed from cs.CV
Latent Geometric Chords for Query-Efficient Decision-Based Adversarial Attacks
Ei Hmue Khine, Yao Li, Jiebao Sun et al. (+3 more)
While decision-based black-box
adversarial attacks present a severe security threat, current methodologies suffer from fundamental limitations. Pixel-wise attacks frequently introduce unnatural, high-frequency visual artifacts, while latent-space frameworks are confined by the limited search space of low-dimensional
manifolds and inherent reconstruction flaws. To resolve these limitations, we propose Latent
Geometric Chords (LGC) for Query-Efficient Decision-Based
Adversarial Attacks alongside a variant, LGC-H. At its core, LGC navigates decision boundaries by executing a
curvature-aware
geometric search within a compressed semantic
manifold. To guarantee high visual fidelity and circumvent dimensionality bottlenecks, we introduce a Residual-based
Adversarial Generation (RAG) mechanism. RAG isolates semantic perturbations as
geometric chords and superimposes them directly onto the original source image. RAG substantially resolves baseline reconstruction flaws and effectively doubles the permissible search space dimensions. Experimental results demonstrate that LGC achieves robust cross-
dataset transferability and substantially outperforms state-of-the-art baselines. Notably, our method, LGC, minimizes perturbation magnitudes while achieving state-of-the-art visual fidelity–with a Structural Similarity Index Measure (SSIM) exceeding 0.99 and a Learned Perceptual Image Patch Similarity (LPIPS) below 0.01 at 5000 queries–and sustaining high attack success rates under stringent perceptual constraints, successfully compromising adversarially trained robust models. The source code is available at: https://github.com/eihmuekhine/Latent-
Geometric-Chords.
Read the full abstract ▾
All authors Ei Hmue Khine, Yao Li, Jiebao Sun, Shengzhu Shi, Zhichang Guo, Boying Wu
Cryptography and Security
MAECO-Lite: Modular Ontology for Dynamic Malware Analysis
Zekeri Adams, Peter Švec, Ján Kľuka et al. (+4 more)
Capturing dynamic malware behavior in a practical but still semantically precise manner remains a significant challenge in cyber threat intelligence. While standards such as MAEC and STIX provide widely adopted vocabularies for describing malware artifacts and observations, they represent data with considerable complexity in structures that often obscure important ontological distinctions. In particular, they tend to conflate enduring malware artifacts with the events generated during execution, thereby flattening distinctions that are central in foundational standards for ontology design. In this paper, we conduct a foundational ontological analysis of core MAEC and STIX constructs relevant to dynamic malware analysis relying on Unified Foundational Ontology (UFO) as a theoretical lens. Our analysis reveals some ontological mismatches arising from the conflation of artifacts, dispositions, and runtime events in MAEC and STIX that complicate coherent representation of dynamic malware behavior and, from a practical perspective, limit the ability to reason about execution traces. Based on these insights, we propose MAECO-Lite, a lightweight ontology designed to represent data and operationalize their processing for dynamic malware analysis. The ontology adopts a modular structure centered on samples, processes, actions, system artifacts, and MITRE ATT&CK Techniques, while maintaining a clear separation between enduring entities and runtime events. An initial evaluation using description logic concept learning
algorithms shows that the simplified ontology significantly improves learning performance, demonstrating that ontologically grounded modelling can enhance both semantic clarity and computational usability.
Read the full abstract ▾
All authors Zekeri Adams, Peter Švec, Ján Kľuka, Roderik Ploszek, Monday Onoja, Štefan Balogh, Martin Homola
Cryptography and Security
EvoDefense: Co-Evolving Black-Box Defense with Large Language Models
Yu Li, Yuenan Hou, Yingmei Wei et al. (+2 more)
Large
Language Models (LLMs) remain highly vulnerable to diverse attacks, particularly in black-box settings where the internals of target models are inaccessible. Existing black-box defenses typically rely on pre-defined filtering heuristics, which often fail to generalize to unseen attack types and target model architectures. We introduce EvoDefense, an experience-guided co-evolving black-box defense paradigm. EvoDefense employs a guard LLM to detect malicious queries and an experience
memory module to accumulate defense knowledge from previous interactions. At the core of EvoDefense is a continuous attack-defense
evolution loop, where an attack generator and the guard model iteratively refine their attack strategies and defense policies through experience-guided optimization. This design enables EvoDefense to generalize across unseen attacks and target models without retraining. Experiments on HarmBench, AdvBench, and AlpacaEval show that EvoDefense achieves consistently strong defense performance across seven popular models and five representative LLM attacks, while preserving competitive general capabilities. On HarmBench, EvoDefense reduces the attack success rate (ASR) of AutoDAN-turbo on Gemini-3-flash and LLaMA-3-8B-Instruct from 29.4% and 43.4% to 8.4% and 6.2%, respectively.
Read the full abstract ▾
All authors Yu Li, Yuenan Hou, Yingmei Wei, Yanming Guo, Chaochao Lu
Cryptography and Security
From Retrieved Evidence to Security Outcomes: A Data-Driven Analysis of Java Security API Misuse in LLM-Generated Code
Tianhe Lu, Eric Spero, Sakuna Harinda Jayasundara et al. (+2 more)
The misuse of Java security APIs is a serious security problem in software development. Large
language models can generate compilable code, while still misusing cryptographic and secure-communication APIs. We investigate whether external security evidence can reduce this risk and how retriever choice and evidence source shape the resulting programs. Our study evaluates the GPT-5.5 model and Llama-3.3-70B-Instruct model on 12 Java Cryptography Architecture (JCA) and Java Secure Socket Extension (JSSE) security functionalities under 11
prompt and evidence conditions, yielding 23,760 generated programs. We measure program validity, detected Java security API misuse, and the top-5 evidence selected by four full-corpus retrievers. Under task-only prompting, 58.5% of valid Llama-3.3-70B-Instruct-generated programs and 36.6% of valid GPT-5.5-generated programs contain detected security API misuse. Dense full-corpus
retrieval reduces conditional misuse among valid programs by 29.0–32.7 and 22.4–31.0 percentage points, respectively. The retrievers show preferences for substantially different evidence types. BM25 and the OpenAI
embedding retrievers favor official guidance, the Qwen
embedding retriever favors code examples, and the Jina
embedding retriever selects a more heterogeneous mixture. Under source-restricted
retrieval, code examples yield the lowest observed conditional misuse for the Llama-3.3-70B-Instruct model, while explicit misuse patterns produce zero detected misuse cases for known
benchmark patterns among 1,016 valid programs generated by the GPT-5.5 model, with validity reduced to 94.1%. External evidence can substantially reduce detected misuse in the evaluated settings, and the results motivate actionable evidence selection and post-generation validation.
Read the full abstract ▾
All authors Tianhe Lu, Eric Spero, Sakuna Harinda Jayasundara, Robert Biddle, Giovanni Russello
Cryptography and Security
From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors
Jiejun Tan, Zhicheng Dou, Xinyu Yang et al. (+4 more)
LLM
agents are evolving from conversational chatbots to operational tools in real-world workspaces. In local agentic harnesses, an LLM can read and write files, call tools, and reuse workspace state across sessions. While such capabilities enhance utility, they also expose a new attack surface for attackers. Attackers can embed a
prompt injection within a file or tool output.
Agents may read this hidden instruction, store it, and execute it later. In this multi-step trojan attack paradigm, no individual step appears malicious on its own, but these steps can collectively turn untrusted text into persistent control content. However, existing defenses often inspect each step in isolation. As a result, they can block a clear harmful action, but fail to detect the earlier write operation that plants the
backdoor. To reveal this threat, we introduce ClawTrojan, a
benchmark designed to identify multi-step trojan attacks in local agentic harnesses. In an OpenClaw-style simulated workspace with GPT-5.4, ClawTrojan reaches a 95.5% attack success rate (ASR), while existing single-turn
prompt-injection attacks produce near-zero ASR on the same model. To address this threat, we propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source. Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
Read the full abstract ▾
All authors Jiejun Tan, Zhicheng Dou, Xinyu Yang, Yuyang Hu, Yiruo Cheng, Xiaoxi Li, Ji-Rong Wen
Cryptography and Security
Thou Shall Not Pass: Gatekeeping Outbound TLS Connections
Henrique B. Brum, Matteo Franzil, Riccardo Germenia et al. (+3 more)
Despite the widespread use of Transport Layer Security (TLS), its security guarantees are frequently compromised by outdated versions and misconfigurations. To analyze this problem, we collected more than 50 million TLS handshakes over a two-week period at our research institution, Fondazione Bruno Kessler, and analyzed three server-selected parameters against the recommendations of four TLS guidelines. Our analysis shows that while the use of insecure or outdated options is minimal, it remains persistent. More importantly, servers are adopting the latest TLS advancements much faster than official guidelines can be updated to provide directives for them. These findings, combined with the difficulty of configuring TLS clients due to their ephemeral, ubiquitous and server-dependent nature, leave users vulnerable to non-standard or outright insecure connections. To address this, we present TLSGatekeeper, a real-time, network-based tool that transparently monitors handshakes, analyzes server parameters, and, based on organizational policy, reports non-compliant connections without requiring client-side modifications. Unlike Next-Generation Firewalls, TLSGatekeeper preserves end-to-end
privacy by validating only handshakes, and offers greater flexibility in defining undesired configurations. Our evaluation shows that TLSGatekeeper sustains traffic rates of up to 100 Gbps while preventing insecure connections, with an average added processing delay of 671 ns (TLS 1.3) and 795 ns (TLS 1.2) per handshake packet, making enforcement feasible at scale.
Read the full abstract ▾
All authors Henrique B. Brum, Matteo Franzil, Riccardo Germenia, Salvatore Manfredi, Domenico Siracusa, Luis A. Dias Knob
Cryptography and Security · Cross-listed from cs.AR
HE^2: A Communication-Light Heterogeneous Architecture for Efficient Fully Homomorphic Encryption
Shangyi Shi, Husheng Han, Zhaoxuan Kan et al. (+8 more)
CKKS, an emerging fully homomorphic encryption (FHE) scheme, has been promising in
privacy-preserving applications by enabling SIMD fixed-point computations on ciphertexts. Despite its strong security guarantees, CKKS involves both compute-intensive operators (ComOps) with high computational cost and
memory-intensive operators (MemOps) with large
memory footprints, making existing ASIC-based or NMP-based acceleration approaches suffer from high hardware overhead and limited efficiency. This observation motivates the integration of the architectural advantages of both paradigms into a heterogeneous xPU (ASIC)-xMU (NMP) architecture. However, in such a design, frequent and long-latency heterogeneous communication caused by the dominant keyswitch operator remains a key performance bottleneck. In this paper, we propose $HE^2$, a communication-light xPU-xMU heterogeneous FHE accelerator with dataflow graph (DFG) optimization and architecture co-design. First, we observe that the majority of communication arises at the interface between ModUp/ModDown and neighboring MemOps. To address this, we propose a DFG-level optimization framework to fully exploit the ModUp/ModDown reduction potential of the hoisting
algorithm by identifying parallel keyswitch blocks and fusing them for reduced communication frequency. Second, we design an efficient heterogeneous architecture that adopts a group-level pipelined execution to effectively hide communication latency by leveraging the inherent parallelism across decomposed groups. End-to-end evaluation results show that $HE^2$ achieves 1.66$\times$ speedup and 9.23$\times$ lower EDAP (Energy-Delay-Area Product) compared to the state-of-the-art accelerator, with communication stalls accounting for only 6.67% of the total latency.
Read the full abstract ▾
All authors Shangyi Shi, Husheng Han, Zhaoxuan Kan, Yinghao Yang, Jianan Mu, Tenghui Hua, Ge Yu, Xinyao Zheng, Ling Liang, Zidong Du, Xing Hu
Cryptography and Security
Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments
Shengchen Ling, Yihang Huang, Yuefeng Du et al. (+4 more)
The x402 protocol has crossed from prototype to infrastructure for the agentic web, driving 130 million all-time transactions and embedded in Google Cloud, Cloudflare, and Stripe. Yet bridging synchronous HTTP requests with asynchronous blockchain finality creates state-synchronization challenges, and x402's security has so far been examined only in piecemeal vendor disclosures. It is moreover not one artefact but a stack of an HTTP semantic, per-chain schemes, and a long tail of SDK and deployment choices whose required guarantees prior work has not established. We perform a systematic security analysis organized around five invariants grounded in specifications, literature, and vendor expectations, resolving every violation to the responsible layer. We identify four flaw classes: cross-resource substitution, duplicate-settlement race (independently corroborated by subsequent third-party reports), allowance overdraft, and denial of settlement. Against official SDKs and a production deployment, these reach resource-leakage ratios up to 100%. For pay-per-
token scheme we prove a structural limit: no output-only pricing can be both fair to honest users and bounded against inflation of the hidden "thinking"
tokens, the price of
fairness being a $\sqrt{1+\Theta}$ manipulation gap. We propose per-flaw mitigations and a defense triple with provable guarantees, cutting per-call
reasoning cost by 47% and inverting attacker leverage from 8.7$\times$ to 0.9$\times$ at only 2.8% overhead. All findings have been disclosed.
Read the full abstract ▾
All authors Shengchen Ling, Yihang Huang, Yuefeng Du, Yuan Chen, Yajin Zhou, Lei Wu, Cong Wang
Cryptography and Security · Cross-listed from quant-ph
Software Platform for Hybrid Pseudo-Random Sequence Generation and Predictability Analysis Based on LFSR and Mersenne Twister
Ali Abdolrahimi Zarnagh and Ali Motazedifard
Generating reliable random and pseudo-random sequences is important in many electronic and signal processing systems, such as secure communications, radar, spread-spectrum methods, and autonomous platforms. Although true and
quantum random number generators provide stronger unpredictability, classical pseudo-random number generators, including Linear Feedback Shift Registers (LFSRs) and the Mersenne Twister (MT), are still widely used because they are efficient and easy to implement. This work introduces a user-friendly software platform for generating, analyzing, and evaluating the predictability of pseudo-random bit sequences. The software supports two main functions: generating sequences using classical PRNGs and hybrid combinations, and analyzing input sequences through statistical measures and data-driven methods. In particular, hybrid LFSR-MT structures are studied to examine how they affect sequence complexity and resistance to prediction. The platform also includes machine-learning and deep-learning tools to investigate when deterministic PRNGs may remain partially predictable, even when their structure becomes more complex. The results show that algorithmic random sequence generators have inherent limitations in terms of unpredictability, which supports the use of
quantum random sequences in security-critical applications. A comparative study between classical LFSR-MT sequences and
quantum random sequences shows that
quantum randomness offers higher unpredictability due to its non-deterministic physical origin. The potential use of
quantum random sequences in jamming applications is also discussed, highlighting their improved robustness against prediction-based attacks. Overall, the proposed software provides a practical tool for analyzing, comparing, and benchmarking random sequence generators in modern electronic, sensing, and
quantum-enabled communication systems.
Read the full abstract ▾
Cryptography and Security
A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation
Wanju Kim, Seoksu Lee and Eun-Sun Cho
Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including
memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools are unable to process. Experimental results demonstrate that the length of obfuscated programs was reduced by approximately 85%, and it was verified through validation that small-scale programs were fully restored to semantics identical to the original.
Read the full abstract ▾
Cryptography and Security
TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking
Churui Zeng, Kedong Xiu, Weiwei Qi et al. (+5 more)
The rise of LLM
agents introduces a new threat by enabling planning, coding, and even end-to-end execution of expert-level attack workflows. However, this threat remains underexplored and underestimated since (i) Safety
alignment prevents LLMs from directly generating harmful instructions. (ii) Most of existing jailbreak methods mainly focus on eliciting harmful instructions but overlook LLM refusal against executing these harmful instructions. (iii) Even if the early execution steps succeed, any intermediate failure or dependency error will interrupt the workflow and force a restart of the entire attack process. To address these limitations, we propose TRACE, an agentic jailbreaking framework that reduces attack difficulty, induces the
agent to execute harmful instructions, and resumes from prior states rather than restarting. Specifically, we first design around 20 procedural decomposition schemes that specify key operations and dependencies for different types of tasks, which can decompose a complex and harmful task into more executable and benign-looking subtask sequences. We measure these candidate sequences along two dimensions, and select the optimal one for instantiating the attack. For the remaining refused subtasks, we construct different subtask profiles and establish an evolving execution-oriented multi-turn jailbreak strategy library corresponding to these profiles. Given the profile of a refused subtask, TRACE can retrieve an appropriate strategy that specifies the corresponding intermediate goals, environment states, and relevant tools to gradually establish a plausible execution context through multi-turn interaction. Extensive evaluations on AdvCUA show that TRACE outperforms existing jailbreak methods across multiple advanced LLM
agents, improving attack success rate by more than 100%. Our code is available at https://github.com/ZJU-LLM-Safety/TRACE.
Read the full abstract ▾
All authors Churui Zeng, Kedong Xiu, Weiwei Qi, Yuqi Hao, Chaochao Lu, Liang He, Zhan Qin, Tianhang Zheng
Cryptography and Security
LLM Anonymization Against Agentic Re-Identification
Ziwen Li, Jianing Wen and Tianshi Li
Agentic LLMs with web search change the threat model for text anonymization: weak contextual cues can become cross-referenceable evidence for re-identification, yet those same details also carry downstream analytic value of the text. Existing defenses either remove explicit identifiers, perturb text for formal
privacy, or test rewritten text against non-web inference models, leaving underexplored the operating region between resistance to agentic web-search re-identification and utility retention. We introduce AURA (Anonymization with Utility-Retention Adaptation), an LLM-powered mask-reconstruct framework that decouples
privacy localization from utility-preserving reconstruction and selects candidates with
adversarial privacy and utility-retention checks. We evaluate AURA on real-user interview transcripts using re-identification attacks carried out by web-search
agents, along with a utility evaluation based on interviewee-profile facts, codebook facts, and the joint contextual utility grid. Our results show that adaptive-scope AURA yields the lowest agentic re-identification counts under each of three attacker models among the non-DP methods, and that at matched scope and backbone, AURA's mask-reconstruct design retains more contextual utility than the prior LLM anonymizer (+6.4 pp unit-grid recovery) at comparable
privacy. Source Code: https://github.com/AaronLi43/AURA
Read the full abstract ▾
Cryptography and Security
Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense
Shuhao Zhang, Jiarui Li, Qi Cao et al. (+2 more)
Prompt-injection detectors are heterogeneous: each is strong on a different slice of attacks, and none is always reliable. Yet existing systems still treat detection as a fixed single-detector pipeline, committing every request to one detector's blind spots. We reframe defense as detector allocation: given a heterogeneous pool, decide per request which detectors to run and whether to escalate to an LLM judge. Our framework SCOUT (Scalable and Controllable Outcome-prediction for Uncertainty-aware Triage) makes this decision dynamic by predicting each detector's per-sample reliability and latency from how it behaved on similar past inputs, and exposes a single safety-utility threshold to the operator (where utility bundles benign-pass rate and wall-clock). To evaluate this setting, we build SCOUT-450, a
benchmark that captures the structurally complex,
agent-facing injections that older
prompt-injection sets under-represent. On SCOUT-450, a safety-oriented operating point reduces attack-success rate by 46% and total wall-clock by 40% relative to an always-on GPT-4o judge, at a 5.1-point benign-utility drop. SCOUT also transfers to three external
benchmarks (BIPIA, IPI, and IHEval), improving the safety-utility frontier.
Read the full abstract ▾
All authors Shuhao Zhang, Jiarui Li, Qi Cao, Ruiyi Zhang, Pengtao Xie
Cryptography and Security
Differentially Private Preference Data Synthesis for Large Language Model Alignment
Fengyu Gao and Jing Yang
Preference
alignment is a crucial post-training step for large
language models (LLMs) to ensure their outputs align with human values. However, post-training on real human preference data raises
privacy concerns, as these
datasets often contain sensitive user
prompts and human judgments. To address this, we propose DPPrefSyn, a novel
algorithm for generating differentially private (DP) synthetic preference data to enable
privacy-preserving preference
alignment. DPPrefSyn is a principled framework grounded in the Bradley-Terry preference model and the intrinsic
geometric structure of pairwise human preference data. It first learns an underlying preference model from private data with formal differential
privacy guarantees, and then leverages the learned model together with public
prompts to synthesize high-quality preference data. It exploits the shared linear structure of per-cluster reward models to effectively capture heterogeneous human preferences in private
datasets, and leverages DP Principal Component Analysis (DP-PCA) to improve learning accuracy. Extensive experimental results demonstrate that DPPrefSyn achieves competitive
alignment performance under strong DP guarantees. These findings highlight the potential of synthetic preference data as a practical alternative for
privacy-preserving preference
alignment across a broad range of applications. To the best of our knowledge, this is the first work to generate DP synthetic preference data for LLM
alignment. Our code is available at https://github.com/gfengyu/Differentially-Private-Preference-Data-Synthesis.
Read the full abstract ▾
Cryptography and Security · Cross-listed from quant-ph
How To Track Qubits Through Space and Time (Or: Sailing in a Quantum Boat)
James Bartusek, Zikuan Huang, Leo Orshansky et al. (+1 more)
While
quantum position verification aims to certify a prover's location using
quantum information, existing security definitions only guarantee that part of the successful
adversarial party is in the claimed location. This leaves open the possibility that a distributed team of adversaries can jointly simulate a prover in a way that defeats the intended meaning of `being at a location' in position-based cryptography. We introduce stronger notions of position verification that we call
quantum localization, which requires that there is a specified, unclonable state at the verified spacetime point-and that this state can be found nowhere else. We show that
quantum localization leads naturally to a meaningful notion of trajectory verification, in which
quantum information is verifiably tracked through space and time. We construct
quantum localization and trajectory verification protocols using
quantum anchor states, which generalize coset states from unclonable cryptography. The security of our schemes is proven in the classical oracle (i.e. ideal obfuscation) model, which can be heuristically instantiated in the plain model using post-
quantum indistinguishability obfuscation. We also introduce and instantiate the concept of functionality localization, which guarantees that the adversary has the ability to compute a secret function at the verified spacetime point, and this function cannot be computed anywhere else. This raises the intriguing possibility of localizing computational capabilities in space and time. More broadly, we believe our notions of
quantum localization and subsequent feasibility results provide stronger foundations for position-based cryptography. At a conceptual level, our results also explore the tight link between two fundamental notions in physics-location and information-thus serving as a natural foundation for cryptographic capabilities tied to physical spacetime.
Read the full abstract ▾
All authors James Bartusek, Zikuan Huang, Leo Orshansky, Henry Yuen
Cryptography and Security
FASR: Automated Identification of Unsafe Control Actions in STPA
Ian Dardik, Yining She, Sam Procter et al. (+3 more)
The System-Theoretic Process Analysis (STPA) is a well-established hazard analysis technique that has been applied to a wide range of safety-critical systems. Despite its popularity, there is relatively little automation support for STPA, and most of its steps are carried out manually by a human analyst, which can be time consuming and error prone. This paper investigates the potential use of model-based engineering and formal methods to assist human analysts in efficiently and accurately carrying out STPA. The proposed tool, called FASR (Formalizing and Automating STPA with Robustness), enables automated, complete identification of unsafe control actions (UCAs), leveraging recent advances in robustness analysis to identify UCAs as undesirable deviations in the controller's actions. The use of the tool is demonstrated on a case study involving a Braking System Control Unit (BSCU) in an avionics system. As a preliminary exploration of the potential benefits and limitations of the tool, the paper reports on a user study involving nine participants with varying backgrounds in STPA, model-based engineering, and formal methods; the study found that most participants considered the tool a useful aid in identifying UCAs, while suggesting improvements that would make a tool such as FASR usable and applicable to a wider range of systems and analysts.
Read the full abstract ▾
All authors Ian Dardik, Yining She, Sam Procter, Keaton Hanna, Lutz Wrage, Eunsuk Kang
Cryptography and Security
Triaging Threats to Specialized Guardrails
Wenjie Jacky Mo, Xiaofei Wen, Rui Cai et al. (+6 more)
Building robust safety guardrails is essential for deploying Large
Language Models across diverse real-world applications. However, this goal remains challenging because safety risks span heterogeneous threat domains, while existing
datasets cover only fragmented risk subsets and rely on inconsistent taxonomies. Consequently, it remains unclear whether current guardrails can generalize beyond narrow evaluation settings. To better understand the robustness of guardrail models, we first introduce GuardZoo, a unified human-annotated
benchmark with 32,460 samples covering 15 distinct unsafe categories. Evaluation on GuardZoo reveals that monolithic guardrails suffer from task interference: different threat domains require distinct decision boundaries that are difficult to compress into a single model. We therefore propose RouteGuard, a router-expert framework that triages each conversation to specialized expert guardrails for threat-specific detection. Experiments show that RouteGuard improves fine-grained threat detection over strong guardrail baselines, generalizes better under out-of-domain evaluation, and supports flexible modular expansion to emerging threats.
Read the full abstract ▾
All authors Wenjie Jacky Mo, Xiaofei Wen, Rui Cai, Boyu Zhu, Sicong Jiang, Zihan Wang, Minglai Yang, Zhe Zhao, Muhao Chen
Cryptography and Security
Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity
Mohammadreza Rashidi
ReAct
agents that interleave chain-of-thought
reasoning with tool calls are increasingly deployed for real tasks such as scheduling, file
retrieval, and data access. Their tool observation loop creates a direct attack surface: an adversary who controls any tool's return value can embed instructions that redirect the
agent away from the user's goal, a threat known as indirect
prompt injection. Existing
benchmarks evaluate attack success rate (ASR) at a fixed injection position under fixed conditions, leaving three risk dimensions unexplored: where in the tool sequence the payload appears (injection depth), what rhetorical register it uses (framing), and how many turns the
agent is permitted (turn cap). We conduct four controlled studies on 20 scenarios spanning five attack categories, totalling 460 trials against GPT-4o-mini and Claude Haiku at a combined API cost under 0.36 USD. Study 1 shows that ASR against GPT-4o-mini decays from 60% at depth 1 to 0% at depths 4 and 5 (Cramer's V = 0.58, p < 0.001; restricted to within-sequence depths 1-3: V = 0.47, p = 0.0013), driven by model resistance at depth 1 and task completion before payload encounter at deeper positions. Study 2 replicates the depth experiment on Claude Haiku, which achieves 0% ASR at every depth through a combination of conservative tool invocation and genuine instruction resistance. Study 3 shows that framing modulates ASR between 25% (neutral) and 75% (persona) at depth 1, a 50-percentage-point range that does not reach statistical significance at N = 20 per condition. Study 4 confirms that ASR is stable across turn caps of 3, 5, and 7, indicating the turn budget is not a risk factor in this setting. Our results establish injection depth as the dominant variable and show that sanitising only the first tool observation captures 67% of measured injection successes.
Read the full abstract ▾
Cryptography and Security
Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents
Brian Crawford and Patrick McClure
Agentic software reverse engineering systems are vulnerable to
prompt injection attacks placed into the source code of executable binary files. This research demonstrates defensive tactics for detecting the presences of
prompt injection strings in the decompiler output of
adversarial example programs. Methods for obfuscating these attacks and subsequent methods for defending against these obfuscations are also explored. This research advances the understanding of risk and security of agentic software analysis systems necessary for their deployment into production-level cyber workflows.
Read the full abstract ▾