Cryptography and Security
Smart Blockchain-Based Access Control for the Internet of Things
Mahdi Manavi, Yunpeng Zhang and Guoning Chen
Securing access control in large-scale Internet of Things (IoT) deployments requires mechanisms that adapt to risk while preserving low latency for benign traffic. Permissioned blockchains such as Hyperledger Fabric offer auditability through smart contracts, but static endorsement policies impose the same validation depth on all requests, regardless of security posture. We propose a risk-adaptive enforcement layer for Hyperledger Fabric that couples an off-chain LSTM-based risk oracle with deterministic on-chain checks. The oracle assigns each request to a tier (Low, Moderate, High) and issues a signed attestation bound to the client identity and target key/version. Endorsing peers verify the attestation in chaincode and enforce tier-conditioned SBE policies without modifying the ordering service or consensus. Experiments on a Fabric testbed show that tier-conditioned endorsement strengthens validation for higher-risk requests while retaining low confirmation latency for benign workloads.
Read the full abstract ▾
Cryptography and Security
SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents
Rui Melo, Riccardo Fogliato, Sean Zhou et al. (+2 more)
Large
language models (LLMs) are increasingly deployed in automated code-review systems, where their approvals can determine which code is merged into shared repositories. However, it is unclear whether review
agents can detect vulnerability-introducing code when an attacker controls both the code change and the persuasive Pull Request (PR) narrative designed to mask it. We introduce SEVRA-BENCH (Social Engineering of Vulnerabilities in Review
Agents), a
benchmark that measures how often a review
agent approves such
adversarial PR s. Each PR in SEVRA-BENCH is built from a historical commit that fixed a vulnerability. We automatically reverse that fix to extract the original vulnerable code, and submit the resulting code change as a PR wrapped in one of 15 social-engineering framings. To test review-
agent resilience to narrative manipulation, these framings vary dimensions such as supporting evidence, conveyed urgency, signals of prior approval, and appeals to authority. SEVRA-BENCH evaluates a retained challenge split of roughly 1000
adversarial PRs drawn from publicly disclosed vulnerability fixes across the top 10 entries of the MITRE's 2025 most dangerous software weaknesses. Evaluating 8 review
agents against this
benchmark, we reveal that review
agents are susceptible to narrative manipulation, exposing a significant gap in security capabilities.
Read the full abstract ▾
All authors Rui Melo, Riccardo Fogliato, Sean Zhou, Pratiksha Thaker, Zhiwei Steven Wu
Cryptography and Security
FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization
Jianwei Wang, Guoyang Shen, Yanhong Wu et al. (+5 more)
Stream guardrails enable
token-level safety detection before full responses are generated. However, they often make overly conservative judgements and block those sensitive but safe
tokens, which is known as over-refusal. Due to lack of full context, they also fail to detect implicitly harmful content from jailbreaking. To address these challenges, we propose FreoStream, a novel streaming guardrail framework. Specifically, FreoStream fine-tunes a LoRA module to perform Future-Aware
Reasoning when the base guardrail detects unsafe
tokens. The
reasoning process follows a Future-Reason-Judge paradigm: predict the future, reason about the full context and give the final judgement. This design can effectively reduce over-refusal by incorporating the future information. Moreover, we introduce the Safety-Aligned Optimization module that extracts the safety-aligned component from the
reasoning gradients to update the base guardrail model, thereby enhancing streaming safety detection. Extensive experiments on various safety
benchmarks demonstrate that FreoStream achieves lower over-refusal rates and better jailbreak defense compared to existing streaming guardrails.
Read the full abstract ▾
All authors Jianwei Wang, Guoyang Shen, Yanhong Wu, Haoran Li, Hao Peng, Huiping Zhuang, Cen Chen, Ziqian Zeng
Cryptography and Security · Cross-listed from cs.AR
A Modern Large-Scale Memory Characterization Laboratory
Ataberk Olgun, Haocong Luo, Ismail Emir Yuksel et al. (+3 more)
Real
memory chip characterization yields insights into fundamental operational characteristics of modern
memory, enabling new mechanisms that improve
memory performance, robustness, security, and energy efficiency. We describe our large-scale DRAM characterization laboratory for understanding DRAM. A key building block of this laboratory is DRAM Bender, a versatile and easy-to-use modern DRAM characterization infrastructure. We have updated DRAM Bender to i) introduce support for new types of characterization experiments, ii) expand on its DRAM interface standard support, and iii) make it easier to use at large scale. This paper introduces these updates for the first time. We hope our infrastructure enables the community to discover new problems and solve critical
memory scaling issues, enabling the overcoming of the huge
memory bottleneck that plagues modern computing systems.
Read the full abstract ▾
All authors Ataberk Olgun, Haocong Luo, Ismail Emir Yuksel, F. Nisa Bostanci, A. Giray Yaglikci, Onur Mutlu
Cryptography and Security · Cross-listed from cs.AI
Shielded Analysis: Certification and Characterization of Defensibility in Systems under Adversarial Interaction
Achraf Hsain and Sultan Almuhammadi
Formal safety analysis determines whether a system admits a safe defense; adaptive evaluation characterizes the operating quality sustained under
adversarial interaction. Both answers matter because systems with the same safety verdict can impose very different operational burdens. We introduce shielded analysis, a design-time framework that derives these answers from one encoded system while keeping the safety requirement and admissible threat model independently variable. It returns a defensibility certificate and a four-axis defensibility fingerprint spanning structural margin, shield latitude, and adaptive operating quality. Each axis is informative in its own right; their relationships show whether formal and operational assessments agree, diverge, or respond differently to system changes. We instantiate the framework for network defense on a reference segment and four controlled perturbations spanning
topology, safety requirements, and adversary capabilities. Every configuration is certified defensible, yet two
topology variants with nearly identical structural profiles sustain mean clean-host fractions of 22.7% and 80.7% under adaptive pressure. Shielded analysis turns a safety-game solution into a comparative instrument: it determines whether a defense exists, characterizes what that defense requires, and identifies which system changes strengthen it.
Read the full abstract ▾
Cryptography and Security
Beyond the IT Checklist: Engineering a Reasonable Standard of Care for Cyber Safety
Matthew E. Jablonski, Linton Wells II, Kathryn B. Laskey et al. (+1 more)
Current U.S. cyber policy, centered on security, often treats documentation of controls and incident reports as a proxy for safety in the built environment. This paper argues that such an approach is inadequate for cyber-physical systems, where digital failures can produce kinetic harm. We construct and code a corpus of critical infrastructure policy documents (N=292, 2000-2025) to examine how "reasonable care" is operationalized across the NIST SP 800-160 Vol.~2 resilience lifecycle. The resulting maps show that obligations are concentrated in the Anticipate phase and emphasize administrative compliance, while Withstand and Recover phases rely heavily on delegated references to IT-focused control catalogs that are poorly aligned with physics-based hazards. We identify three major disconnects: miscalibrated delegated standards, recovery defined as notification rather than engineered
navigation, and uneven adaptation requirements across sectors. We then propose a modernized standard of care anchored in hazard-specific traceability, structured assurance cases, and cyber resiliency engineering. Finally, we recommend that federal policy pair these engineering obligations with targeted incentives so that resilient architectures for critical infrastructure become a viable business decision rather than an unfunded expectation.
Read the full abstract ▾
All authors Matthew E. Jablonski, Linton Wells II, Kathryn B. Laskey, F. Brett Berlin
Cryptography and Security
Differentially Private Hierarchical Heavy Hitters
Ari Biswas, Graham Cormode, Yaron Kanza et al. (+2 more)
The task of finding _Hierarchical_ Heavy Hitters (HHH) was introduced by Cormode et al. [VLDB 2003] as a generalisation of the heavy hitter problem. While finding HHH in data streams has been studied extensively, the question of releasing HHH when the underlying data is private remains unexplored. In this paper, we study differentially private HHH release in both the streaming and non-streaming setting. In the non-streaming setting, we show the surprising result that the relative error in estimating the residual count for any prefix is independent of the height of the hierarchy and the number of heavy hitters in the stream. Meanwhile, in the streaming setting, although the exact version of HHH has low global sensitivity (as counting queries are 1-sensitive), the approximation functions due to streaming have high global sensitivity, linear in the available space. Despite this obstacle, we show that the absolute error for estimating frequencies in the steaming setting is independent of the available space.
Read the full abstract ▾
All authors Ari Biswas, Graham Cormode, Yaron Kanza, Divesh Srivastava, Zhengyi Zhou
Cryptography and Security
Intent-Based Cryptographic API Design for Cryptographic Agility
Navaneeth Rameshan and Gregoire Messmer
As organizations move toward post-
quantum cryptography, they face the major challenge of updating cryptographic
algorithms across large, complex software portfolios. However, most cryptographic APIs in use today were designed around specific
algorithms. These APIs expect explicit use of specific
algorithms, provide little or no support for policy-based
algorithm selection, and offer no straightforward way to migrate existing keys to newer
algorithms. This makes the transition to post-
quantum cryptography challenging. The companion assessment framework identifies the barriers to cryptographic agility and explains why
algorithm transition is largely a software engineering problem. To address the limitations of current cryptographic APIs, we identify the principles necessary to design a cryptographically agile API. The design principles are derived from five fundamental architectural characteristics (Abstraction, Stability, Temporal Flexibility, Separation, and Extensibility). We also show how the design principles can be implemented using several examples of Protocol Buffers API design patterns. In particular, we present an intent vocabulary that is based on scopes which allows for decoupling key creation from
algorithm identities. It also supports transparent substitutions of
algorithms in the applicable scope. Cryptographic governance is enabled by an abstract policy API that does not prescribe the policy format. Keys are represented by stable identifiers and support key
evolution operations (rotation, transformation, migration), facilitating migration between
algorithms and providers while tracking both the original key identity and its
evolution history. With this approach, updating cryptography becomes an operational process without the need to rewrite application code.
Read the full abstract ▾
Cryptography and Security
An Assessment Framework for Application-Level Cryptographic Agility
Navaneeth Rameshan and Gregoire Messmer
The impending post-
quantum transition to new cryptography will require complete replacement of
algorithms within all software. The cryptographic APIs used today make this transition challenging because they were not designed with agility as a concern. There is no method for systematically assessing cryptographic agility as an overall ability. In addition to this, the term itself refers to multiple independent capabilities. Specifically, it includes replacing
algorithms, selecting by policy, and substituting implementations. This lack of structured decomposition limits both the evaluation of systems and the development of cryptographically agile APIs. We introduce a component-based assessment framework that characterizes application-level cryptographic agility along seven orthogonal dimensions: three coupling dimensions that measure what the application code knows about
algorithms and providers, a cross-cutting decoupling mechanism, a governance authority dimension, and two agility enablers that measure actual migration capability. The framework is non-linear and captures non-hierarchical profiles: a system may achieve high operation decoupling yet low creation decoupling, or strong versioning without externalized configuration. We evaluate six representative APIs (PKCS#11, OpenSSL~3.0, JCA, Google Tink, AWS KMS, and HashiCorp Vault Transit) against the framework, revealing three pervasive and independent gaps: no system supports intent-based key creation, none provides policy-driven
algorithm selection (as distinct from access control), and none offers dedicated/first-class operations for
algorithm transformation of existing keys. These gaps are individually sufficient to prevent agile migration, explaining why the post-
quantum transition remains a software engineering problem despite decades of API progress.
Read the full abstract ▾
Cryptography and Security
Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents
Zihao Wang, Yiming Li, Yutong Wu et al. (+8 more)
LLM-based web
agents are increasingly deployed in real-world settings such as e-commerce, where they interact extensively with untrusted web content while executing actions that carry direct financial consequences. This makes them vulnerable to
prompt-injection attacks, in which seemingly benign web content conceals
adversarial instructions that manipulate the
agent's behavior. Existing security
benchmarks adopt an attack-centric perspective, focusing on the technical feasibility of injections while overlooking the nuanced distribution of resulting harms. In practice, however,
prompt-injection risk is victim-dependent: a single exploit can produce asymmetric consequences for different stakeholders, and the same attack pattern may exhibit substantially different effectiveness depending on whom it targets. To capture these properties, we introduce StakeBench, a stakeholder-centric
benchmark that systematically categorizes and attributes harm in real-world web
agent systems for online shopping. In general, StakeBench decomposes
prompt-injection risk into 12 concrete attack objectives across three stakeholder classes, realized by 22 reusable templates and instantiated into 264 executable
adversarial cases spanning 12 product categories, with each case evaluated along complementary outcome- and process-level metrics. Evaluating four deployable
agent-backbone configurations across 3,168 attacked runs, we find substantial and heterogeneous vulnerabilities: no attack objective is reliably resisted by current LLM-based web
agents, and outcomes span four qualitatively distinct modes. These patterns are missed by conventional attack-centric, single-metric evaluation, underscoring the need for stakeholder-aware assessment of LLM-based
agents in real-world deployments.
Read the full abstract ▾
All authors Zihao Wang, Yiming Li, Yutong Wu, Kangjie Chen, Zheyu Liu, Fok Kar Wai, Pin-Yu Chen, Vrizlynn L. L. Thing, Bo Li, Dacheng Tao, Tianwei Zhang
Cryptography and Security · Cross-listed from cs.DS
Split Tallies: A Discrete Certificate Calculus for Auditing Dynamic Ordered Sets in Constant Memory
Faruk Alpay and Levent Sarioglu
We study retrospective
auditing for dynamic ordered sets maintained by an untrusted party. A passive auditor watches insert, delete, membership, predecessor, successor, min, and max operations, stores five machine words and a flag, and receives a constant-size public tally record per operation. At audit time the maintainer discloses the claimed live vacant intervals. The method represents order semantics by maximal gaps: gaps are born, cited, consumed, and timestamped, while two hidden field accumulators test equality of the birth and consumption ledgers. Honest executions are accepted with probability one. If any answer in a T-operation session is wrong, acceptance occurs with probability at most (4T+1)/p over one secret field element, against computationally unbounded maintainers. We prove that deterministic and visible-coin auditors require linear state, and that removing the timestamp rule permits an exact replay forgery. A leaf-oriented (2,4)-tree implements the maintainer in O(log n) worst-case time per operation with one extra word per element, and its rebalancing events admit an auditable O(m) envelope over m updates. Checkpoint audits compose with additive error.
Read the full abstract ▾
Cryptography and Security
The Invisible Ink of the Android Malware World: A Longitudinal Study on the Usage of Covert Communication Channels
Zeya Umayya, Manan Aggarwal, Manan Chugh et al. (+3 more)
Proxies, VPNs and Tor have long helped the
privacy community and users in censored regions to fight censorship. However, the same tools can be maliciously exploited by malware and botnets to conceal their communication to external command and control servers. Despite being a critical concern fueled by the proliferation of malware based attacks, no longitudinal studies have analyzed how malware applications use covert channels (CC) to evade detection. We fill this gap by performing the first study of the usage of covert channels in the Android malware ecosystem. To that end, we develop a multistage pipeline that combines static and dynamic analysis to investigate both system and network-level features. We applied this pipeline on a corpus of 3.5M Android malware spanning 2009 to July 2025. Our carefully crafted static validation rules uncovered 288K APKs that used CCs spanning 511 malware families and CC usage growing exponentially from 0.30% (2012) to 50% (2025). Overall, in dynamic analysis, we identified 19,308 unique IP addresses being contacted in 85 countries, out of which we were able to explicitly validate the presence of CCs for 59 IP addresses across 17 countries. Further, we performed a longitudinal
dataset study spanning over 16 years for CC based malware and found that CC usage has evolved, e.g., some malware adopted by using more than one CCs; others switched between them periodically (one family switched CC usage 40 times from 2019 to 2025).
Read the full abstract ▾
All authors Zeya Umayya, Manan Aggarwal, Manan Chugh, Mann Nariya, Yogesh Kaushik, Sambuddho Chakravarty
Cryptography and Security
The Emergence of Autonomous Penetration Capabilities in Large Language Model-Powered AI Systems
Jiaqi Luo, Jiarun Dai, Zhile Chen et al. (+8 more)
Nowadays, the autonomous execution of cyberattacks capable of causing substantial real-world harm is widely regarded as one of the critical red lines that frontier AI systems must not cross. Within this broader red-line scenario, autonomous penetration represents a core enabling capability and subtask: the ability of LLM-powered AI systems to independently conduct
adversarial operations against a target server without human intervention, identify and exploit vulnerabilities, and obtain unauthorized access or control. A growing body of work has sought to assess the autonomous penetration capabilities of AI systems. However, existing evaluations often employ opaque methodologies, rely on unrealistic or overly simplified penetration-testing scenarios, or provide LLMs with excessive prior knowledge and task-specific guidance, and cannot accurately capture the extent to which modern AI systems can autonomously perform this core capability within broader high-impact cyberattack scenarios. To address these limitations, we construct a new autonomous penetration evaluation framework consisting of two components: target servers and
agent scaffolding. Specifically, on the target-server side, we design two levels of target environments based on the number of secure services without known vulnerabilities deployed alongside a vulnerable service: Tier~1 (one secure service) and Tier~2 (three secure services), resulting in a total of 300 target servers. Meanwhile, the
agent scaffolding adopts a general-purpose
agent architecture equipped with a set of general-purpose cybersecurity tools, without any target-specific prior knowledge. We evaluate 19 open-weight and proprietary LLMs, and find that current models achieve penetration success rates ranging from 10.7% to 69.3%. Moreover, we observe that autonomous penetration capability continues to improve alongside advances in overall model capability.
Read the full abstract ▾
All authors Jiaqi Luo, Jiarun Dai, Zhile Chen, Jia Xu, Weibing Wang, Yawen Duan, Brian Tse, Geng Hong, Xudong Pan, Yuan Zhang, Min Yang
Cryptography and Security
DIG: Oracle-Guided Directed Input Generation for One-Day Vulnerabilities
Andrew Bao, Haochen Zeng, Peng Chen et al. (+2 more)
One-day vulnerabilities pose significant risks due to delayed or incomplete patch adoption. Generating proof-of-concept (PoC) inputs is therefore essential for assessing real-world impact. The key challenge is identifying necessary constraints for triggering the vulnerability and solving them effectively. Existing directed fuzzing approaches prioritize inputs toward target locations, but neither explicitly identify necessary constraints nor solve them effectively, relying instead on target-distance feedback and random mutation. Agentic approaches show strong potential through code
reasoning and structured input generation, but goal drift in long-horizon
reasoning limits their effectiveness. DIG addresses this challenge by exploiting a key property of one-day vulnerabilities: patches often reveal necessary preconditions for triggering. DIG uses an LLM to analyze the patch and synthesize an oracle making these conditions explicit. The oracle supports effective PoC generation at two levels. At the high level, DIG performs oracle-guided generator
evolution, where an
agent infers and solves constraints to satisfy the oracle. At the low level, DIG instruments the oracle into the target program and uses branch-distance feedback to guide random mutation in directed fuzzing. Evaluation shows DIG outperforms 2 state-of-the-art
agents and 10 fuzzers across 138 real-world CVEs. DIG triggers 80 vulnerabilities, surpassing prior results and outperforming the best baseline by 40% (57 vs. 80 CVEs). Notably, DIG exclusively triggers 9 vulnerabilities no existing technique can trigger. Compared to the average of other tools, DIG triggers vulnerabilities faster in 92.9% of cases, achieving over 100x speedup in 48.8% of cases, with a maximum speedup of 3,664x. Beyond one-day PoC generation, DIG uncovers 6 previously unknown vulnerabilities in widely deployed libraries, enabling zero-day discovery.
Read the full abstract ▾
All authors Andrew Bao, Haochen Zeng, Peng Chen, Stephen McCamant, Pen-Chung Yew
Cryptography and Security
SoK: The Constant Time Model
Billy Bob Brumley
Constant time programming patterns is the primary defense against timing attacks on cryptographic implementations, yet what "constant time" means varies across academia and industry. This work systematizes constant time models and their
evolution, identifies a recurring gap between what models protect and what specifications assume, and distills an offensive methodology for discovering timing vulnerabilities that originate outside the cryptographic primitive boundary. Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CV
Efficient, Robust, and Anti-Collusion Fingerprinting of Image Diffusion Models
Jianwei Fei, Yunshu Dai, Zhihua Xia et al. (+4 more)
Model fingerprinting,
embedding user-specific identifiers (fingerprints) into generated outputs, has recently emerged as a popular solution to protect the intellectual property rights (IPR) of generative text-to-image (T2I) models and prevent unauthorized redistribution. In this work, we reveal a previously unexplored systematic vulnerability in existing generative model fingerprinting methods: they lack robustness against collusion attacks, where multiple attackers combine their models to remove or obscure the fingerprints. To address this issue, we take the first step towards a robust fingerprinting method for T2I models with anti-collusion capabilities. The proposed method encodes strings of bits, namely fingerprints, into the coefficients of a personalized normalization module (PNM) incorporated into T2I models, so that fingerprints can be reliably recovered from any generated image. To defend against collusion attacks and prevent unauthorized model redistribution, we introduce an anti-collusion mechanism based on lossless function-invariant parameter transformations. This mechanism significantly degrades the image generation quality of colluded models, making them effectively unusable. Moreover, our method allows developers to efficiently create multiple copies of fingerprinted T2I models by reparameterizing the PNM without the need for retraining. We also introduce a worst-case optimization strategy to improve robustness against model-level attacks. Our experiments demonstrate that the proposed method achieves high fidelity and robustness across multiple T2I image generation and editing tasks, with fingerprint extraction accuracy exceeding 99.5%. Compared with existing methods, our method demonstrates, for the first time, a notable proactive robustness to collusion attacks by significantly increasing the FID of colluded models.
Read the full abstract ▾
All authors Jianwei Fei, Yunshu Dai, Zhihua Xia, Xiaochun Cao, Jiantao Zhou, Alessandro Piva, Benedetta Tondi
Cryptography and Security
ViPER: Vision-based Packing-Aware Encoder for Robust Malware Detection
Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal et al. (+1 more)
Visualization-based malware detection maps raw binary bytes to grayscale images and applies learned visual classifiers, providing an evasion-resistant and disassembly-free alternative to conventional analysis pipelines. However, executable packing remains a critical failure mode: packed binaries produce high-
entropy images that obscure the structural patterns these models rely on. Because packing is also prevalent in benign software (e.g., for compression or copy protection), packing state alone is not a reliable indicator of maliciousness, and existing approaches do not address this challenge within a unified supervised framework. We present ViPER, a
Vision-based Packing-Aware Encoder for Robust malware detection. ViPER builds on a LoRA-adapted ViT-B/14 backbone with a dual-head architecture that jointly learns malware classification and packing detection. A packing-aware gating mechanism conditions malware predictions on the inferred packing state, enabling distinct decision boundaries for packed and unpacked inputs. To address packing label skew during training, we employ frequency-weighted losses with stratified sampling over joint class-packing strata. Evaluated on 200,000 Windows PE byteplot images, ViPER achieves a balanced accuracy of 0.8521, ROC-AUC of 0.9260, and AUPR of 0.9279, outperforming representative state-of-the-art baselines across all primary metrics, while attaining a packing detection AUC of 0.9949.
Read the full abstract ▾
All authors Fatima Qaiser, Bisma Tahir, Muhammad Abid Mughal, Nauman Shamim
Cryptography and Security
MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems
Chejian Xu, Zhaorun Chen, Jingyang Zhang et al. (+5 more)
Hierarchical multi-
agent systems (MAS) are rapidly being deployed in high-stakes workflows across domains such as finance and software engineering. In these systems, safety and security are inherently distributed across role-specialized
agents, significantly expanding the attack surface, particularly under coordinated
adversarial behaviors such as privilege escalation and cross-
agent collusion. Existing red-teaming approaches for MAS remain limited: they rely on heuristic selection of target
agents and perturb isolated message streams, leaving critical questions unanswered as which
agents are most responsible for system safety, and how compromised
agents can coordinate to bypass defenses. We propose MAStrike, a closed-loop framework for collusive red-teaming in hierarchical MAS. We propose the first
agent-level Shapley value analysis for MAS, quantifying each
agent's marginal contribution to system robustness under task-specific distributions. GGuided by this attribution, MAStrike identifies vulnerable
agent coalitions and generates coordinated, role-aware
adversarial manipulations. These attacks are iteratively refined through structured causal diagnosis, attributing failure cases to uncompromised
agents that block
adversarial attempts. We further build a comprehensive MAS red-teaming
benchmark and controllable environments spanning diverse hierarchical
topologies and domains, including finance, software engineering, and CRM. Extensive experiments across MAS built on multiple frontier models show that MAStrike substantially outperforms heuristic baselines. Our analysis further uncovers non-trivial Shapley value distributions and higher-order interaction structures among
agents, revealing critical vulnerabilities and coordination patterns that are overlooked by prior single-
agent or template-based methods.
Read the full abstract ▾
All authors Chejian Xu, Zhaorun Chen, Jingyang Zhang, Freddy Lecue, Avni Kothari, Sarah Tan, Wenbo Guo, Bo Li
Cryptography and Security · Cross-listed from cs.LG
PolicyGuard: Towards Test-time and Step-level Adversary (Backdoor) Defense for Reinforcement Learning Agent
Junfeng Guo Heng Huang
While real-world applications of reinforcement learning (RL) are becoming increasingly popular, the security of RL systems deserve more
attention and exploration. In particular, recent work has revealed that RL
agents are vulnerable to
backdoor attacks, where a victim
agent behaves normally under standard conditions but executes malicious actions when a specific trigger is activated. Existing
backdoor defenses for RL either require access to the
agent's internal parameters, operate only at the model or trajectory level, or are limited to specific attack types. To ensure the security of RL
agents, we propose PolicyGuard, a test-time step-level
backdoor defense which leverages Gaussian Process (GP) posterior variance and adapts pseudo trajectories to enable uncertainty computation for individual time step. Besides, we also provide theoretical foundations to explain the efficacy of GP posterior variance. Extensive experiments across seven RL games demonstrate that PolicyGuard achieves state-of-the-art detection performance in most cases, with average AUROC of 0.856 for perturbation-based attacks and 0.859 for adversary-
agent attacks.
Read the full abstract ▾
Cryptography and Security
LNTest: A Testbed for Evaluating Bitcoin Lightning Network-Based Botnets
Thomas Bakaysa, Ahmet Kurt, Abdul-Salem Beibitkhan et al. (+6 more)
Bitcoin's Lightning Network (LN) can be exploited as a covert, low-cost command-and-control (C&C) channel for botnets, as demonstrated by the LNBot and D-LNBot designs. However, both remain proof-of-concept prototypes evaluated only through simulation, leaving key questions about real-world
topology formation, propagation complexity, and resilience to takedowns unanswered. We present LNTest, the first reusable testbed for LN-based botnets, built from Core Lightning nodes containerized with Docker over a shared Bitcoin Core regtest chain. LNTest supports three overlay
topology modes (a deterministic chain, autonomous peer discovery, and user-supplied graphs), enabling controlled experiments across different botnet structures. Using LNTest, we report three main findings. First, D-LNBot's autonomous formation protocol does not produce the uniform chain from its design; instead, it creates a clustered chain in which cliques are linked by bridge nodes whose removal fragments the network. Second, command propagation scales linearly with botnet size ($\Theta(n)$), not the $O(m \log n)$ previously claimed, and gains nothing from higher neighbor connectivity. Third, the overlay
topology determines the effectiveness of takedown strategies: uniform-degree chains resist targeted removal but fragment under random failure, scale-free
topologies show the opposite pattern, and the autonomous clustered chain is fragile under both, making it the most vulnerable of the three. LNTest is released as open source, with a script that reproduces all our experiments, to support reproducible research on LN-based botnet defenses.
Read the full abstract ▾
All authors Thomas Bakaysa, Ahmet Kurt, Abdul-Salem Beibitkhan, Jesus Maria Romo Diaz de Leon, Tag Kalat, Joshua Kramer, Estela Rodriguez, Abraham Watkins, Abdullah Aydeger
Cryptography and Security
A Privacy-Preserving Framework Using Remote Data Science for Inter-Institutional Student Retention Prediction
John Fields, K M Sajjadul Islam, Ruchitha Thota et al. (+2 more)
This study explores
privacy-preserving machine learning (PPML) techniques using the PySyft platform to enable collaborative prediction of student retention between institutions. We developed a remote data science (RDS) framework with a semi-air-gapped architecture consisting of high-side and low-side servers, allowing researchers from three universities to build predictive models on sensitive student data without direct data access. Using historical data from a small private university (N=720), we evaluated three synthetic data generation approaches and validated the framework through inter-institutional collaboration. The results demonstrate consistent classification performance across institutions (Macro F1: 0.690–0.695) while maintaining strict Family Educational Rights and
Privacy Act (FERPA) compliance. We also propose Data-Type-Aware Templates, a novel synthetic data method that prioritizes
privacy over distributional fidelity. Our findings confirm that RDS-based PPML is technically feasible for educational settings and offers a practical alternative to
federated learning for small-scale inter-institutional collaborations. The code is available at https://github.com/jtfields/NAIRR240195-
Privacy-Preserving-Machine-Learning.
Read the full abstract ▾
All authors John Fields, K M Sajjadul Islam, Ruchitha Thota, Victor Chen, Praveen Madiraju
Cryptography and Security
Semantic Matching of Behavioral Primitives for MUD-Based IoT Device Identification
Samuel Witt and Hassan Habibi Gharakheili
Accurate identification of Internet of Things (IoT) devices, such as cameras, lightbulbs, and voice assistants, is important for security management and policy enforcement. Existing approaches identify devices from packet- or flow-level traffic characteristics. Manufacturer Usage Description (MUD) profiles provide a complementary, policy-level representation of intended device communication via Access Control Entries (ACEs), which encode protocol, endpoint, direction, and port semantics. While exact ACE matching is effective when observed behavior overlaps with the reference profile, it provides little evidence when that overlap becomes sparse. This paper investigates the semantic matching of individual ACEs as behavioral primitives for MUD-based IoT device identification. Our specific contributions are threefold. (1) Using 28 publicly available MUD profiles containing 1,023 ACE instances, we show that representing individual ACEs preserves behavioral distinctions that are obscured when an entire profile is represented by a single vector. (2) Through controlled experiments with unseen ACEs, endpoint perturbation, and partial observation, we characterize how semantic matching behaves as exact overlap decreases. (3) Using real IoT traffic traces comprising more than 800,000 flows, we show that semantic matching provides stronger evidence during early and sparse-overlap observations, whereas exact matching becomes stronger as stable overlap accumulates. These results demonstrate that semantic ACE matching can complement exact MUD matching when runtime observations provide limited literal overlap with reference profiles. We release the code and research artifacts to support reproducibility.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Detecting Functional Memorization in Code Language Models
Matthieu Meeus, Anil Ramakrishna, Shengyuan Hu et al. (+3 more)
Large
language models (LLMs) are increasingly used to generate code at scale. Meanwhile, prior work has investigated whether training data may be recoverable from model outputs, by
auditing the textual overlap between training examples and model generations. Code, however, can preserve the same logic while differing substantially in syntax and structure. We here study functional memorization: the leakage of training data logic from LLM generations in ways that textual audits fail to detect. We leverage AI coding
agents to generate diverse test inputs for training data functionality and evaluate whether model-generated continuations produce the same outputs. We formalize this through a counterfactual framework, comparing target models (exposed to specific code) against reference models (not exposed) and requiring functional equivalence only for the target. We instantiate this framework across 4 open-source models and explicitly filter for functions with meaningful logic in 5 programming
languages. We find that 0.3-3.4% of filtered functions are counterfactually functionally memorized, i.e., reproduced with equivalent behavior in restructured code that textual metrics fail to detect. We further show that LLM-based judges offer a scalable proxy for execution-based testing, achieving a true positive rate of 68% at 1% false positive rate, and find that functional memorization is associated with semantic duplication in the training corpus.
Read the full abstract ▾
All authors Matthieu Meeus, Anil Ramakrishna, Shengyuan Hu, Matthew Grange, Zheng Xu, Luca Melis