Cryptography and Security
MOLOT System Card: Malicious Operational Logic Observation Transformer
Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky et al. (+1 more)
MOLOT (Malicious Operational Logic Observation
Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime,
memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public
benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows.
Read the full abstract ▾
All authors Daniil Lopatkin, Maksim Mitrofanov, Stanislav Rakovsky, Aleksandr Khalikov
Cryptography and Security
ScaleDisturb: Exploiting Temporal Asymmetry to Amplify Read Disturbance in Modern DRAM Chips
Jikun Wang, Haocong Luo, Ataberk Olgun et al. (+6 more)
DRAM suffers from read disturbance phenomena (e.g., RowHammer and RowPress), where repeatedly accessing or continuously keeping open a DRAM row (aggressor row) induces bitflips in other physically nearby unaccessed rows (victim rows). The disturbance mechanism is practically exploitable from the software stack and worsens across generations with continued density scaling. DRAM read disturbance is highly sensitive to
memory access patterns, yet prior work explores read disturbance under only a limited set of access patterns. We present ScaleDisturb, a new DRAM access pattern that can amplify DRAM read disturbance by asymmetrically extending the open time of two aggressor rows. Our rigorous experimental characterization of 196 DDR4 and 3 HBM2 DRAM chips shows that ScaleDisturb (1) leads to bitflips at significantly fewer row activations, compared to state-of-the-art
memory access patterns, (2) makes read disturbance attacks easier across all tested DRAM chips, (3) increases DRAM vulnerability to read disturbance as DRAM manufacturing technology scales down to smaller node sizes. We showcase a proof-of-concept attack on a real system where a user-level program leveraging ScaleDisturb induces more bitflips than state-of-the-art RowHammer and RowPress
memory access patterns. We describe and evaluate four solutions for mitigating read disturbance bitflips in the presence of ScaleDisturb and call for more research on the topic.
Read the full abstract ▾
All authors Jikun Wang, Haocong Luo, Ataberk Olgun, İsmail Emir Yüksel, A. Giray Yağl{\i}kç{\i}, Yu Liang, F. Nisa Bostanc{\i}, Mohammad Sadrosadati, Onur Mutlu
Cryptography and Security
SHIELD-IDS: Structurally Heterogeneous Ensemble with Integrated Layered Defense for Intrusion Detection Systems
Maryam Zaman and Muhammad Khuram Shahzad
Adversarial attacks pose a serious and growing threat to Machine Learning (ML)-based Intrusion Detection Systems (IDS), where imperceptible perturbations to network flow features can systematically mislead classifiers into accepting malicious traffic as benign. The IDS-Anta framework partially addresses this through Z-score normalization, Singular Value Decomposition (SVD), and Multi-Armed Bandit (MAB) classifier selection with Thompson Sampling, yet its classifier pool lacks sufficient structural diversity for robust
adversarial resistance. This work introduces IDS-Anta++, which incorporates XGBoost and LightGBM gradient boosting models into the ensemble and wraps the extended pool in a three-layer black-box defense: Isolation Forest anomaly screening, median feature smoothing, and six-way majority voting. Experiments conducted on CIC-IDS-2017, CEC-CIC-IDS-2018, and CIC-DDoS-2019 under both Fast Gradient Sign Method (FGSM) and Zeroth Order Optimization (ZOO) attacks confirm detection accuracy above 99% on clean data, with measurable robustness gains under
adversarial conditions relative to the baseline IDS-Anta configuration.
Read the full abstract ▾
Cryptography and Security
MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models
Rishabh Makwana, Mamta, Deeksha Varshney et al. (+1 more)
Vision-
Language Models (VLMs) have demonstrated strong performance across
multimodal tasks, yet their safety robustness remains an open challenge. While prior work has shown that structured visual
prompts such as flowcharts can effectively jailbreak VLMs, existing studies are largely limited to English-centric settings. In this paper, we introduce MLingualFC, a
multilingual multimodal benchmark designed to evaluate jailbreak vulnerabilities of VLMs across diverse
languages using structured flowchart representations. MLingualFC encodes harmful instructions into flowchart images across five
languages (Hindi, Punjabi, Spanish, Romanian, and German). We evaluate state-of-the-art
multilingual VLMs, including Qwen2.5-VL, Gemma-4, and Pangea, under a black-box threat model. Our results reveal significant
multilingual safety gaps. Flowchart-based attacks achieve high attack success rates (ASR) in case of Latin script
languages, demonstrating that visual encoding of harmful content effectively bypasses safety
alignment across
languages. In contrast, non-Latin script
languages such as Punjabi exhibit substantially lower ASR, suggesting potential limitations in visual text recognition rather than stronger safety
alignment. These findings highlight that current VLM safety mechanisms fail to generalize across
languages and modalities. Resources are available at https://github.com/Rishabhpm23/MLingualFC
Read the full abstract ▾
All authors Rishabh Makwana, Mamta, Deeksha Varshney, Oana Cocarascu
Cryptography and Security
Verifiable and Confidential DNN Inference on Low-End Edge Devices
Mohamed Khalil Kiri, Ivan De Oliveira Nunes, Aurélien Francillon et al. (+1 more)
Deploying deep neural network (DNN) inference on low-end edge devices raises two key challenges: protecting model confidentiality against a potentially compromised edge system and enabling verifiable inference without incurring prohibitive overhead. Existing approaches either house partial models and inference software within trusted execution environments (TEEs), resulting in high cost and an application-dependent trusted computing base (TCB), or execute in untrusted environments, providing little security. In this work, we present VECODI, a framework for verifiable and confidential DNN inference on constrained edge devices. At its core, VECODI introduces SHANGRI-LA, a new execution abstraction on TrustZone-M TEEs that establishes a third runtime environment with privileges strictly between the Secure and Non-Secure Worlds. VECODI leverages SHANGRI-LA to execute untrusted inference code in the Non-Secure World while using minimal application-agnostic Secure-World support to protect model confidentiality and enable verifiability (with respect to proper execution of inference code and model parameters) of inference results. We realize VECODI on a real-world NUCLEO-L552ZE-Q development board and open-source its prototype. Our results show VECODI's small TCB,
memory footprint, and runtime overhead, making it a practical option for secure inference in low-end edge devices.
Read the full abstract ▾
All authors Mohamed Khalil Kiri, Ivan De Oliveira Nunes, Aurélien Francillon, Norrathep Rattanavipanon
Cryptography and Security · Cross-listed from cs.IT
Sort, Partition, Randomize: Optimal Binary Hypothesis Testing under Local Differential Privacy
Elena Ghazi, Jawad Nasser, Flavio Calmon et al. (+1 more)
We study optimal design of $\varepsilon$-locally differentially private mechanisms for binary hypothesis testing. Each observation is drawn from one of two known distributions $P_0,P_1$ on a finite alphabet of size $k$, privatized by a mechanism $Q$, and then used to infer which distribution generated the data. We measure testing utility using an $f$-divergence, including total variation, KL, and hockey-stick divergences, between the two induced output distributions. Previous work established structural properties of optimal mechanisms, but only yielded exponential-time
algorithms. We prove a sharp structure: for every $\varepsilon$ and every $f$-divergence objective, after sorting the alphabet by likelihood ratio, there exists an optimal mechanism that partitions the sorted alphabet into contiguous blocks and applies randomized response to the block label. We call this class Sort-Partition-Randomize (SPR). This characterization yields an exact dynamic program that computes an optimal mechanism in $O(k^3)$ time, and more generally in $O(\ell k^2)$ time with an $\ell$-output budget. Our results make it possible to efficiently compute and characterize the exact optimum across the full
privacy range, beyond asymptotic
privacy regimes.
Read the full abstract ▾
All authors Elena Ghazi, Jawad Nasser, Flavio Calmon, Ibrahim Issa
Cryptography and Security
Lost in Migration: Exposing Android Framework Vulnerabilities in Parallel Java-Kotlin Implementations
Rui Li, Wenrui Diao and Debin Gao
Android has adopted Kotlin alongside Java across apps and core system components. During this shift, we observe parallel implementations in the Android Open Source Project (AOSP) where the same component is implemented in both Java and Kotlin. In principle, their functional purposes are identical. In practice, subtle semantic divergences can appear. Such divergences are not vulnerabilities by themselves, but they provide useful clues that may reveal flaws in surrounding enforcement logic. To the best of our knowledge, this paper presents the first systematic study of Java-Kotlin parallel implementations in the Android framework and examines their security implications. We design and build ParaDroid, an analysis framework that identifies parallel methods at scale and compares their behaviors. ParaDroid normalizes code into a bytecode-level intermediate representation, reconstructs class-to-source mappings, and uses large
language models to reason about method semantics and identify behavioral divergences. Evaluated on AOSP Android 14-16, ParaDroid identified 329 parallel method pairs and 37 vulnerable divergences. We responsibly disclosed the exploitable issues to the Android Security Team. Three vulnerabilities and two bugs have been confirmed, and two CVE IDs have been assigned. Our results demonstrate that parallel Java-Kotlin code paths provide a practical surface for discovering security flaws in modern Android.
Read the full abstract ▾
Cryptography and Security · Cross-listed from eess.SY
An End-to-End Encrypted Control Pipeline for Multi-Agent Coordination via CKKS Homomorphic Encryption
Sai Sandeep Damera, Maria Charitidou, Asim Zoulkarni et al. (+1 more)
Cloud-based coordination of multi-
agent systems requires sharing state with a central server, creating a conflict between coordination and
privacy. Fully homomorphic encryption (FHE) resolves this in principle, but its severe arithmetic constraints demand that every stage of the control loop be redesigned from first principles. We present an end-to-end encrypted control pipeline in which sensing, state estimation, state propagation, and consensus control all operate on CKKS-encrypted data using only addition, multiplication, and cyclic rotation. In order to overcome the computational challenges of FHE, we employ steady-state Kalman gains instead of solving for the
matrices online and graph
Laplacians are applied via the diagonal method at a cost proportional to the number of nonzero cyclic diagonals, accommodating ring,
torus, and complete-graph
topologies within a unified framework. To quantify the cumulative effect of encryption noise, we use the separation principle to decouple controller and observer error dynamics and derive a periodic bootstrapping bound in which CKKS bootstrapping acts as an impulsive disturbance; the resulting steady-state error ball depends on the bootstrapping precision and the closed-loop spectral radius, providing a direct design equation for the
privacy-accuracy tradeoff. The pipeline is validated on a multi-
agent formation control scenario, confirming stable closed-loop operation under encryption with bounded tracking error.
Read the full abstract ▾
All authors Sai Sandeep Damera, Maria Charitidou, Asim Zoulkarni, John S. Baras
Cryptography and Security
On the Shoulders of Giants: Empowering Automated Smart Contract Auditing via the GiAnt Corpus
Xiaoting Zhang, Zhipeng Gao, Yiran Lv et al. (+3 more)
High-quality smart contract
auditing datasets are crucial for evaluating security tools and advancing smart contract security research. Two major limitations of existing
datasets are the manual-induced scalability bottleneck and the deficiency in data granularity and diversity. To address these limitations, we propose
GiANT, an automated framework designed to curate smart contract
auditing datasets by distilling vulnerability insights from real-world
auditing reports.
GiANT employs a divide-and-conquer strategy coupled with the Chain-of-Thought technique to extract structured vulnerability information from Code4rena reports, followed by an LLM-as-a-judge mechanism to perform rigorous quality assurance. To evaluate
GiANT's effectiveness, we run it on 388 real-world audit reports and generate the
GiAnt Corpus comprising 7,711 vulnerability findings across five severity levels. Manual assessment of the
dataset demonstrates exceptional reliability in information extraction, achieving a mean quality score of $4.76\pm0.37$ (out of 5) with inter-rater agreement $\kappa$ of 0.88. We further validate the practicality of our
dataset by benchmarking 4 state-of-the-art LLMs on vulnerability detection, code summarization, mitigation recommendation, and automated gas optimization tasks, to establish performance baselines, thereby providing a valuable data foundation for future research in automated smart contract
auditing.
Read the full abstract ▾
All authors Xiaoting Zhang, Zhipeng Gao, Yiran Lv, Xing Hu, Feifei Niu, Xin Xia
Cryptography and Security
Empirical Evaluation of Large Language Models for Migration of Code Fragments to Post-Quantum Cryptography
Javier Pallarés de Bonrostro, Ana I. González-Tablas and María Isabel González Vasco
The transition to post-
quantum cryptography (PQC) requires not only replacing vulnerable cryptographic primitives, but also refactoring the surrounding software logic. While existing PQC migration frameworks provide organizational guidance, practical code-level remediation remains largely manual and error-prone. This paper evaluates whether large
language models (LLMs) can be trained to assist in the migration of pre-
quantum cryptographic code fragments to post-
quantum counterparts while preserving functional correctness. To this end, we introduce a reproducible experimental framework built around a synthetic
dataset of 800 paired Python code fragments covering six cryptographic families and combined multi-primitive cases. Each pair is validated through category-specific functional tests, enabling both
dataset quality control and objective evaluation of model-generated migrations. Four models are assessed: GPT-4.1 in a zero-shot setting, and fine-tuned versions of GPT-3.5-turbo, GPT-4.1-mini, and CodeLlama-7B-Instruct. The results show that domain-specific fine-tuning is essential for reliable cryptographic migration. The fine-tuned GPT-4.1-mini model achieves the best overall performance, with a mean static similarity of 0.9072 and a dynamic functional correctness rate of 92.5%, substantially outperforming the zero-shot baseline. A complementary validation on six open-source repositories further shows that the approach can produce useful migrations in localized cryptographic modules, while also revealing limitations in larger projects with complex dependencies and cross-module interactions. These findings suggest that fine-tuned LLMs can serve as practical components in future crypto-agile migration pipelines, provided they are coupled with automated verification and dependency-aware validation.
Read the full abstract ▾
Cryptography and Security
Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics
Hangtao Zhang, Yucheng Zhao, Sishun Liu et al. (+8 more)
Jailbreak
prompts can bypass
alignment guardrails in large
language models (LLMs) and elicit unsafe outputs, making reliable deployment-time detection critical. Prior detection approaches largely rely on a fixed metric space, e.g., raw inputs, gradients, or hidden features, in which benign and jailbreak
prompts are linearly separable. We show this assumption breaks under (i) pseudo-malicious
prompts that are benign by intent but contain safety-related keywords, and (ii) adaptive attacks that explicitly optimize against the deployed detector. To overcome this limitation, we shift our focus from identifying a universal metric space to analyzing the more robust neighborhood structure of the underlying data
manifold. We present
Manifold Trajectory Kinetics (MTK), which treats an LLM as a kinetic system transforming inputs into outputs and detects jailbreaks by tracking how a
prompt's neighborhood structure evolves across layers. Benign
prompts remain close to benign neighborhoods throughout inference, whereas jailbreak
prompts exhibit a characteristic trajectory that begins near malicious seeds and later strategically shifts toward benign neighborhoods to evade refusal.Across four LLMs and ten jailbreak attacks, MTK achieves strong robustness to both failure modes: on pseudo-malicious
prompts, it attains a jailbreak true positive rate of 95% at a false positive rate of 5% on benign
prompts and 2% on pseudo-malicious
prompts, and under adaptive attacks, it maintains a true positive rate of 85%. We further demonstrate the superior performance of MTK for jailbreak detection in
vision-
language models. Our code is available at https://github.com/Rookie143/mtk.
Read the full abstract ▾
All authors Hangtao Zhang, Yucheng Zhao, Sishun Liu, Ziqi Zhou, Zeyu Ye, Wei Wan, Minghui Li, Shengshan Hu, Yanjun Zhang, Yi Liu, Leo Yu Zhang
Cryptography and Security
AVPKEET: Exact-Request Authorization and Publicly Verifiable Equality Testing over Encrypted Data
Xiuping Li, Kaiwen Wang and Xiaolin Chang
In cloud storage, cryptographic techniques are commonly used to support secure search and matching while protecting users' data
privacy. Public-key encryption with equality test (PKEET), a widely studied primitive, allows an authorized computation to determine whether two ciphertexts contain the same message without decrypting either of them. Applying PKEET to outsourced sensitive data nevertheless creates three practical risks. (1) Broad authorization may let a requester compare records beyond the approved case; (2) an untrusted cloud may skip the computation or report a false answer; (3) a cloud holding reusable testing material may silently compare stored records without permission and learn hidden relationships among them. Existing approaches do not jointly address these risks. We therefore propose AVPKEET with exact-request authorization and public verification. Exact-request authorization restricts each approval to one stored-ciphertext/query pair and one registered requester, preventing the approval from being transferred to another context. An untrusted cloud worker stores and forwards encrypted data, while a small isolated controller validates the exact request and performs the test without releasing its long-term secret. Every response includes a publicly checkable proof, so anyone holding the request and response can verify the reported “same” or “different” answer without a verification secret. We establish correctness and formal security within the stated threat model. Experiments show that every complete protocol
algorithm finishes within 9.1~ms at the 95th percentile on one CPU thread and that a complete request–response transcript occupies 1,809 bytes, demonstrating the practicality of the proposed scheme.
Read the full abstract ▾
Cryptography and Security
Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features
Yichang Sun, Andreas Johnsson and Sourasekhar Banerjee
Machine learning-based intrusion detection systems (IDS) for RPL-based IoT networks often rely solely on routing layer features, which provide only a partial view of network behaviour. In this work, we investigate whether incorporating Transmit (TX) and Receive (RX)
radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS. We evaluate the proposed approach across three different attack types, namely DIS-Flooding, Local Repair, and Worst Parent under varying network sizes. The results show that incorporating TX and RX improves the IDS's overall detection performance by up to ~4% in F1-score compared with using routing-layer features alone, with the most notable gain observed for the Worst Parent attack.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.IT
The Capacity of Information-Theoretic Secure Aggregation in Federated Learning
Lanxin Yi, Jinbao Zhu, Kai Wan et al. (+1 more)
Secure aggregation allows a server to aggregate users' local updates while preserving update
privacy. Existing information-theoretic problems typically assume that correlated random keys are provided by a trusted third party (TTP) or generated via prescribed groupwise structures, while the communication cost for establishing such correlated keys is often ignored. Consequently, the fundamental limits under general key-distribution mechanisms remain unknown. In this paper, we study the $T$-colluding information-theoretic secure aggregation problem with $N$ users under a general two-phase framework consisting of a key distribution phase and an update aggregation phase. Unlike prior work, we model key distribution through user-to-user communication and allow arbitrary user-generated key-distribution mechanisms, eliminating TTP or prescribed structures. This enables a joint characterization of three resources: randomness for security, key-distribution communication, and aggregation communication. We completely characterize the capacity region among these three resources by constructing a novel secure aggregation scheme together with a matching information-theoretic converse. In particular, we develop an explicit deterministic capacity-achieving construction over any finite field of size at least $N$, whereas most existing schemes either rely on TTP or employ randomized or existential constructions over sufficiently large finite fields. We further show that the optimal performance can be achieved using only pairwise shared keys, enabling implementation via Diffie–Hellman key exchange. Compared with Google's seminal secure aggregation scheme, the proposed scheme requires fewer random masking keys while preserving the same aggregation communication overhead.
Read the full abstract ▾
All authors Lanxin Yi, Jinbao Zhu, Kai Wan, Xiaohu Tang
Cryptography and Security · Cross-listed from cs.SD
A Large-Scale Per-Speaker Analysis of Re-identification Risk in Speech Anonymization
Orane Dufour, Paul Magron, Mickael Rouvier et al. (+1 more)
Speech anonymization is commonly evaluated using averagecase metrics such as the equal error rate, which can hide large disparities in re-identification risks across individuals. In this paper, we conduct a large-scale per-speaker
privacy analysis using a linkability-based metric under a worst-case scenario. Nearly 5,000 speakers are evaluated across multiple anonymization systems, attacker architectures, and conversation lengths. While linkability scores are highly polarized at the speaker level, the sets of easy to re-identify and hard to re-identify speakers vary substantially across configurations. We show that no single factor explains speaker vulnerability. Instead, the re-identification risk emerges from the interaction between the attacker, the anonymizer, and the amount of available
speech. These results challenge the notion of intrinsic speaker-level
privacy risks and emphasize the need for evaluation protocols that are explicitly conditioned on the attacker and anonymizer.
Read the full abstract ▾
All authors Orane Dufour, Paul Magron, Mickael Rouvier, Emmanuel Vincent
Cryptography and Security
Synthetic APTs: the Collapse of TTP-Based Attribution
Francesco Balassone, Víctor Mayoral-Vilches, María Sanz-Gómez et al. (+8 more)
Cyber Threat Intelligence CTI attribution relies on identifying the Tactics, Techniques, and Procedures TTPs that distinguish one threat actor from another. This approach presupposes that each adversary leaves a recognizable operational fingerprint. This work investigates whether AI driven adversary emulation challenges that presupposition. We deploy
agents from our Cybersecurity SuperIntelligence CSI framework, configured as five Advanced Persistent Threat APT groups, APT28, APT29, APT41, APT44, and Lazarus Group, against AI driven Defender
agents across two cyber ranges provided by CYBER RANGES, equipped with defensive software Wazuh, Velociraptor, Elasticsearch and active AI driven defenders: an enterprise network and a military infrastructure. Across 20 experiments using two defender models, a binary pattern emerges: all 10 Enterprise range experiments resulted in compromise 2 to 12 hosts per experiment, while all 10 Military range experiments were successfully defended or resulted in stalemates, regardless of APT profile or defender model. In 8 of 10 Enterprise experiments, attackers independently weaponized the defender's own Velociraptor endpoint management platform as a command and control channel, a convergent behavior not encoded in any threat intelligence profile. We argue that in the AI era, wherein
agents can be deployed provided the right models are available and subject to the right scaffolding and agentic configuration, the entry barrier for operating like a nation state APT collapses: beyond nation states, individuals can now act like commonly identified threat actors, and with it, fundamentally undermine TTP based attribution.
Read the full abstract ▾
All authors Francesco Balassone, Víctor Mayoral-Vilches, María Sanz-Gómez, Paul Zabalegui-Landa, Stefan Rass, Davide Quarta, Daniel Sanchez-Prieto, Marina Oteiza-Álvarez, Almerindo Graziano, Lauren Min Kim, MinSeok Choi
Cryptography and Security
From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability
Bijaya Dangol
Agent-interoperability protocols such as A2A and MCP standardize what
agents say to one another but assume address-based transport. Whether over HTTP(S) or a content-protecting binding such as MLS-based SLIM, these transports protect message content yet leave the communication graph exposed: which
agent contacts which, when, and how often. In
agent systems this graph is more consequential than a
privacy framing suggests. Endpoints are capability-labeled, workflows are structured and chained, and interactions are coupled to actions, so an observer recovers more than past relationships: it can recognize a recurring pending workflow from its opening and, at machine speed, act on it before it completes. The threat is one of workflow integrity, not
privacy alone. We give a threat model for the communication graph and locate what makes its metadata distinctively consequential: not stronger fingerprinting but exposure across independent trust domains, coupled to autonomous action. We define transport- and bootstrap-layer
privacy properties, give them an indistinguishability-game semantics, evaluate transports, and give an A2A case study where a metadata-protecting binding surfaces its implicit identity assumptions. On a corpus of real multi-
agent A2A traffic from the official reference
agents, on a live A2A binding, and with a generative model as a controlled instrument, a label-blind classifier recovers a task's class from passive metadata at 6x chance, and from only its opening; a defense-aware adversary does not overturn this, and only the full set of properties drives recovery toward chance. Acting on the leak is distinct from recoverability: under a fixed budget an adversary captures 0.63 of a clairvoyant attacker's advantage on the corpus (0.41 from a workflow's opening), governed by top-ranked precision rather than overall accuracy, so integrity and
privacy come apart under defense.
Read the full abstract ▾
Cryptography and Security
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
Wenbo Guo, Wei Zeng, Chengwei Liu et al. (+5 more)
AI coding
agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-
language instructions, executable scripts, and tool permissions. Because a skill is at once code and
agent-facing instruction, it introduces a supply chain dependency whose risk is neither pure code nor pure
prompt. Detection tools have never been measured against verified ground truth spanning this hybrid space, leaving their effectiveness unknown and wild-only evaluations biased. We present MalSkillBench, the first runtime-verified
benchmark of malicious
agent skills: 3,944 malicious skills labeled along a three-dimensional taxonomy of 108
cells. Of these, 3,214 come from a closed-loop Generate-Verify-Feedback pipeline admitting only samples whose malicious behavior fires inside a Docker sandbox under system-call monitoring and an LLM judge; we add 703 in-the-wild and 4,000 matched benign skills. Our measurements are consistent: code injection reaches 94.5% verification yield but
prompt injection only 75.8%, the same fragility that later makes it hard to detect; the wild sample is narrow, dominated by one cryptocurrency-theft campaign (86.6% one behavior, 81% from two accounts) with a small but architecturally new tail attacking the
agent control plane; the strongest skill-specific detector reaches 98.4% recall on code injection yet collapses on
prompt-injection and
agent-control attacks, and wild-only scoring swings the ranking by up to 66 recall points; supply-chain scanners and
prompt-injection defenses each see only half of a skill, and no combination recovers the code-instruction relationship. Detecting malicious skills therefore requires
reasoning jointly over task intent, code, and instructions. We release the
dataset, pipeline, baselines, and results.
Read the full abstract ▾
All authors Wenbo Guo, Wei Zeng, Chengwei Liu, Xiaojun Jia, Yijia Xu, Lei Tang, Yong Fang, Yang Liu
Cryptography and Security · Cross-listed from cs.CL
TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents
Vijitha Mittapalli, Shreyaa Jayant Dani, Satya Srujana Pilli et al. (+7 more)
Autonomous LLM
agents can pursue hidden malicious objectives through sequences of individually benign actions, making sabotage difficult to detect using standard trajectory-level monitoring. Existing approaches either evaluate complete trajectories in a single pass or partition them into independently scored windows, limiting their ability to connect evidence across temporally distant actions. We propose TRACE, a monitoring framework for long-horizon LLM
agent trajectories. TRACE operates through a TIJ (Triage-Inspect-Judge) loop that identifies high-signal regions, performs targeted inspection while maintaining accumulated evidence across
reasoning steps, and synthesizes a trajectory-level verdict. We evaluate TRACE on ten task domains from SHADE-Arena against state-of-the-art baselines. TRACE achieves an aggregate F1 of 0.713 and recall of 0.844, with the largest gains on tasks requiring long-range evidence linking.
Read the full abstract ▾
All authors Vijitha Mittapalli, Shreyaa Jayant Dani, Satya Srujana Pilli, Snigdha Ansu, Mohammadreza Teymoorianfard, Franck Dernoncourt, Hongjie Chen, Yu Wang, Ryan A. Rossi, Nesreen K. Ahmed
Cryptography and Security
Fast Bounded-Independence Functions and Their Duals
Martijn Brehm, Yuval Ishai and Nicolas Resch
We continue the study of fast functions, computable by linear-size
circuits, that share useful properties of random functions. Motivated by cryptographic applications, we generalize and improve on previous results in this area, obtaining the following results: - For any constant $t$, we construct a fast $t$-wise independent hash function with algebraic degree $\log_2 t$ (over $\mathbb F_2$), simultaneously optimizing both asymptotic
circuit size and degree. - We simplify and improve a recent construction (ITCS 2026) of a family of fast codes with fast duals, both meeting the Gilbert-Varshamov bound. Unlike the previous construction, our construction has negligible failure probability, can accommodate general fields and rates, supports a systematic encoding, and admits fast universal encoders. - We strengthen the above to support stronger random-like properties, such as optimal combinatorial list-decoding. This is achieved by constructing, for any constant $t$, a family of fast linear functions that map any $t$ linearly independent inputs to uniform and statistically independent outputs. Prior to our work, this was only known for $t=1$. We demonstrate the usefulness of the above results to cryptography. This includes the first nontrivial protocols for perfectly secure multiparty computation whose
circuit complexity scales linearly with the number of parties, as well as protocols for computing encrypted
matrix-vector products with optimal asymptotic
circuit complexity.
Read the full abstract ▾
Cryptography and Security
The Sound of Malware: A Memory Forensics Approach for Android Malware Analysis via Audio Signals
Silvia Lucia Sanna, Massimo Palozzi, Leonardo Regano et al. (+2 more)
Android malware analysis is currently facing increasing challenges in achieving robust classification and detecting stealth attacks. Modern threats employ advanced evasion strategies such as code obfuscation, dynamic loading, packing, and even steganographic manipulation of traditional static and dynamic features. These techniques reduce the effectiveness of signature-based systems and degrade the reliability of Machine Learning models that depend on explicit semantic indicators such as permissions, API calls, or control-flow structures. In this work, we propose \approachname, a
memory forensics malware detection framework that shifts the analysis perspective from semantic program modeling to signal-based structural representation. Both static bytecode and early-execution
memory snapshots are transformed into audio waveforms through direct binary-to-waveform mapping, preserving low-level structural patterns without requiring disassembly or feature engineering. The resulting signals are processed using handcrafted spectral descriptors, Convolutional Neural Networks, and
transformer-based
embeddings. Experiments on CICMalDroid2020
dataset and VirusTotal malware demonstrate that \approachname achieves up to 98.0% accuracy, outperforming static sonification and competitive state-of-the-art approaches.
Read the full abstract ▾
All authors Silvia Lucia Sanna, Massimo Palozzi, Leonardo Regano, Riccardo Lazzeretti, Giorgio Giacinto
Cryptography and Security
HAVE: Host Active Verification Engine for Closing the Contextual Reality Gap in Security Digital Twins
Vincenzo Sammartino and Marco Pasquini
Security Digital Twins (SDTs) provide continuously updated virtual replicas of infrastructure for threat simulation, yet they rely on theoretical CVSS scores to assign lateral-movement probabilities – creating the Contextual Reality Gap: risk is overestimated where unacknowledged mitigations neutralize exploits, and drastically underestimated where logic flaws bypass all
memory-safety defenses. We present the Host Active Verification Engine (HAVE), an SDT extension that deploys a safety-constrained host
agent to measure the empirical probability of compromise $\hat{p}$ via maximum-likelihood estimation over snapshot-isolated Bernoulli trials. A Wilson interval-width confidence weight $\alpha_w$ propagates $\hat{p}$ into Monte Carlo simulations via a
Bayesian blending rule formally related to the Beta-Binomial posterior. Evaluation across four vulnerability classes, three security tiers, and two production binaries shows HAVE reduces $P_{\text{reach}}$ by 38.2% in false-positive scenarios and increases it by 132.4% in false-negative scenarios, with a net +124.1% correction; post-HAVE estimates vary by only $1.12\times$ across calibration exponents $\kappa$, versus $4.6\times$ for CVSS-only baselines.
Read the full abstract ▾
Cryptography and Security
What You See Is Not What AI Gets: DPAgent-in-the-Middle Defense Against AI-Groomed Deceptive Patterns
Zewei Shi, Ruoxi Sun, Haoyang Li et al. (+4 more)
Privacy deceptive patterns in web interfaces manipulate users into disclosing personal data, yet existing defenses are fragmented, static, and increasingly vulnerable to manipulation by large
language models. Moreover, data voids, areas of information scarcity on the web, allow adversaries to inject misleading content that can be scraped and learned by AI systems, amplifying both deceptive design and model misbehavior. In this paper, we formalize AI grooming as a new threat in which adversaries seed benign-looking artifacts carrying machine-consumable manipulative signals into AI-mediated workflows. To address this threat, we present DPAgent, an agentic,
reasoning-aware framework that orchestrates four specialized
agents combining latent-space purification with defensive prompting to explore, detect, and repair
privacy deceptive interfaces in live web environments. Extensive evaluations show that DPAgent filters 91% of naive whole-page generated samples and consistently reduces attack success across five targeted grooming strategies, achieves state-of-the-art detection with a micro F1 of 0.82, explores over 80% of pattern types while visiting only about 10% of the pages required by baselines, and successfully repairs 89.7% of correctly detected PDP instances. Our results demonstrate the promise of
agent-in-the-middle defenses for securing the web UI supply chain against deceptive design and emerging AI threats rooted in data void exploitation.
Read the full abstract ▾
All authors Zewei Shi, Ruoxi Sun, Haoyang Li, Seong Oun Hwang, Feng Liu, Minhui Xue, Xingliang Yuan
Cryptography and Security
Blockchain Infrastructure for Intelligent Cyber–Physical–Social Systems:Post-Quantum Security, Interoperability, and Trustworthy Data Economies in the Era of Embodied AI
Song Guo, Huawei Huang, Dongping Liu et al. (+2 more)
The deployment of
embodied artificial intelligence via world-model-based robotics presents a transformative opportunity for blockchain infrastructure, establishing urgent demand for trustworthy data provenance, cross-organizational governance, and incentive-compatible sharing across decentralized ecosystems. Simultaneously,
quantum computing advances recognized by the 2025 Nobel Prize in Physics and the Turing Award threaten the cryptographic primitives securing these data economies, creating an interdependent imperative: long-lived verification for
embodied AI depends on crypto-agile architectures capable of withstanding
quantum adversaries. This tutorial examines blockchain as the coordination layer bridging this dual transition, from financial substrate to foundational Cyber-Physical-Social Systems infrastructure that simultaneously secures against
quantum cryptanalysis and enables scalable, trustworthy data economies. The session opens with an immersive AWS Braket demonstration engaging participants with superconducting, trapped-ion, and neutral-atom hardware to assess cryptographic threat timelines and witness ECDSA-to-post-
quantum signature transitions. Five integrated modules progress from
embodied AI and world-model requirements through
quantum hardware reality and evidence-based security migration, to scalable cross-shard architectures via BrokerChain protocols, trustworthy data economies implementing Croissant metadata standards and robotic learning provenance, and industry ecosystem integration for multi-modal cloud deployment. By bridging
quantum hardware realities with
embodied AI data requirements, this tutorial charts blockchain as unified infrastructure for next-generation decentralized intelligent environments, providing open-source frameworks and roadmaps for architecting
quantum-resistant, interoperable, and data-trustworthy systems.
Read the full abstract ▾
All authors Song Guo, Huawei Huang, Dongping Liu, Aoyu Zhang, Luyao Zhang
Cryptography and Security
FDM: A Framework for Decision-making to build ML-based Malware detection systems
Tadiwa Vhito, Jakapan Suaboot, Warodom Werapun et al. (+1 more)
Selecting appropriate machine learning (ML) configurations for malware detection is a complex, multi-criteria problem. Model choice, feature engineering, and update mechanisms must jointly satisfy operational constraints that vary across deployment contexts. This paper proposes the Framework for Decision-making (FDM) to build ML-based malware detection systems. The FDM formalises this selection process using the Weighted Configuration Compatibility Score (WCCS), a multi-criteria scoring function mapping five operational parameters (platform constraint, resource budget, response latency, update frequency, and detection sensitivity) to ranked recommendations across nine configuration dimensions. To validate the framework, four experiments were conducted on three
datasets (a private Windows API
dataset, the public Malimg image
benchmark, and an Android static API
dataset). Key results include: (i) XGBoost achieved the best accuracy-to-resource ratio in binary classification (97.46 % test accuracy, <70 MB RAM), outperforming LSTM/BiLSTM which consumed up to 2.8 GB; (ii) in multi-class classification, classical models (XGBoost 79.03 %) outperformed recurrent deep models (BiLSTM 72.27 %), reversing the binary ranking; (iii) class-incremental learning with EfficientNetB0 maintained 99.13 % accuracy with only 0.65 pp degradation across 11 incremental steps; (iv) transfer learning reduced training time by 2.14 times on average for image-based malware data without significant accuracy cost; and (v) autoencoder pre-processing yielded a 14 times training speedup at a cost of only 0.86 pp accuracy. These findings confirm that the optimal ML configuration is context-dependent, validating the FDM's core premise and demonstrating its practical utility for cybersecurity practitioners.
Read the full abstract ▾
All authors Tadiwa Vhito, Jakapan Suaboot, Warodom Werapun, Norrathep Rattanavipanon
Cryptography and Security · Cross-listed from cs.CL
An Expanded Synthetic Conversation Dataset for Multi-Turn Smishing Detection
Carl Lochstampfor and Ayan Roy
Our prior work introduced COVA, a synthetically generated multi-turn conversational smishing
dataset of 3,201 labeled conversations, establishing baseline detection
benchmarks across eight models. While XGBoost with TF-IDF features achieved the best performance, with 72.5% accuracy and 0.691 macro F1,
transformer models underperformed, which was attributed to input truncation and insufficient training data. We present COVA-X, an expanded
dataset of 10,985 conversations spanning eight elder-targeted scam categories, produced by an improved generation pipeline addressing contamination, label mismatch, stage-direction bleed, and
prompt-design failures from the first iteration. Retraining all classifiers on the expanded
dataset yields the central finding of this work: Longformer now surpasses XGBoost on all evaluation metrics, achieving 79.71% accuracy and 0.7786 macro F1 compared with 78.43% and 0.7563 for XGBoost. This directly confirms that
transformer models require larger conversational corpora to realize their contextual advantages. We additionally document a quality life-cycle including a 12.7$\times$ improvement in label correction rate, from 49.8% to 3.9%, an architectural intervention reducing virtual-kidnapping artifact rates from 67.1% to 46.5%, and a per-scam-type outcome analysis showing that scam categories modulate results in mechanism-consistent ways. A pre/post-cleanup sensitivity analysis confirms that
dataset refinement recovers genuine label-relevant signal across all three classifier architectures.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CV
Unified Safe In-context Image Generation in Multimodal Diffusion Transformers via Restricting Unsafe Information Flows
Xiang Yang, Feifei Li, Mi Zhang et al. (+4 more)
Diffusion transformers (DiTs) equipped with
multimodal attention (MM-Attn) have become a dominant paradigm for image generation. However, preventing the generation of harmful content remains a critical challenge, particularly in image-to-image (I2I) editing tasks. Existing safety mechanisms are primarily designed for text-to-image (T2I) synthesis or U-Net-based architectures, which limits their effectiveness for unified safety mitigation in DiT-based frameworks. To bridge this gap, we propose Unified Visual Safety Regulator (UVR), a training-free safe generation framework that regulates unsafe semantics in generated images. UVR is grounded in an analysis of
attention dynamics from the perspective of information flow in MM-Attn. We identify a task-independent start-up stage, during which unsafe semantics in output patches rapidly emerge and can be accurately localized, followed by task-specific semantic amplification and interference stages, where harmful signals are further propagated and entangled with benign content. Based on these observations, UVR mitigates unsafe generation through unified, targeted
attention modulation and explicit restriction of harmful information flow over the identified unsafe output patches. Experiments across various concepts show that UVR achieves state-of-the-art safety performance by achieving 91% and 77% erase rate in image synthesis and editing tasks, while preserving visual quality and fidelity with minimal degradation. Code is available at https://github.com/deng12yx/UVR.
Read the full abstract ▾
All authors Xiang Yang, Feifei Li, Mi Zhang, Geng Hong, Xiaoyu You, Mi Wen, Min Yang
Cryptography and Security
On the Incentive Compatibility of Block Propagation in Bitcoin
Fumichika Maeda, Akira Sakurai, Taishi Nakai et al. (+1 more)
Bitcoin is permissionless and does not rely on any central administrator, which gives it strong censorship resistance. At the same time, it is important to incentivize miners to behave in ways that align with the interests of the system as a whole. This paper asks whether miners are individually incentivized to propagate blocks, one of the most fundamental processes in Bitcoin. Miners collectively maintain the blockchain by generating blocks and disseminating them across the network. If miners have an incentive not to propagate some blocks, this would indicate a fundamental flaw in Bitcoin's incentive design. Although prior work has studied how propagation delays affect forks and mining rewards, it has not fully characterized miners' incentives to improve block propagation under different tie-breaking rules. To address this gap, we derive analytical reward expressions for each tie-breaking rule based on a blockchain network model that captures the effect of forks on mining
fairness. These expressions explicitly characterize how block propagation delays, hashrate distribution, and tie-breaking rules jointly determine mining rewards. We then use them to analyze miners' incentives to improve block propagation. Our results show, for example, that miners have no mining-reward incentive to relay blocks generated by other miners. By contrast, under the first-seen rule, every non-majority miner is incentivized to receive other miners' blocks more quickly and to propagate its own blocks more quickly. Finally, we compare tie-breaking rules and identify a trade-off between propagation incentives and mining
fairness. In particular, the first-seen rule provides the strongest incentives to reduce propagation delays, but it also worsens mining
fairness the most.
Read the full abstract ▾
All authors Fumichika Maeda, Akira Sakurai, Taishi Nakai, Kazuyuki Shudo
Cryptography and Security · Cross-listed from cs.LG
Hearing the Unspoken: Language Model Priors for Acoustic Adversarial Attacks
Jiani Xie, Andrew C. Cullen, Paul Montague et al. (+1 more)
Automatic
Speech Recognition (ASR) systems operating in real-time settings must process acoustic input under strict temporal constraints, where transcription decisions are inherently made on incomplete information. This causal constraint serves as an information bottleneck on attackers, significantly limiting attack performance. Our new Semantic Gambit attack overcomes this causal limitation by augmenting the adversary with predictive context derived from a Large
Language Model in real-time. Our experiments show that this form of augmentation can elevate the corpus-level Word Error Rate to 35.6%-a three-fold increase over the current state-of-the-art streaming attack. Ultimately, this work reveals how common, low-latency LLM tooling can be exploited to systematically subvert real-time ASR pipelines.
Read the full abstract ▾
All authors Jiani Xie, Andrew C. Cullen, Paul Montague, Benjamin I. P. Rubinstein
Cryptography and Security
AMD-FCG: An Enhanced Function Call Graph Dataset with Integrated Topological Features for Malware Detection and Classification
Parthajit Borah, Sakshi Singh, D.K. Bhattacharyya et al. (+1 more)
As malware illustrates a complex structure and behavior, detection of these has been a significant challenge in the domain of cybersecurity along with related services in daily life. So, it becomes crucial to have a reliable and adaptive solution to address the issue. Among the several detection methods developed over the years, one of the most reliable ones is studying and analyzing the structural and behavioral patterns of malware. These patterns of sophisticated malware can be obtained with the help of Function Call Graphs (FCGs). However, to effectively cover numerous groups of families of malware, it is required to have a sufficiently large
dataset for the system to operate on. In order to ensure accuracy and robustness of the system, the
dataset should comprise samples of different malwares and a benign application for secure execution of the detection process. This paper introduces AMD-FCG, an enhanced Function Call Graph
dataset integrated with topological features of malwares. The framework enhances the detection procedure, streamlining the workflow for cybersecurity professionals and also eliminating the need for dynamic analysis and extensive processing. Therefore, it can be used to develop and deploy more efficient and innovative malware detection systems.
Read the full abstract ▾
All authors Parthajit Borah, Sakshi Singh, D.K. Bhattacharyya, J.K. Kalita