Cryptography and Security
Enhancing Stateful Detection of Adversarial Attacks with Soft-labels' Temporality and Robust Similarity Approximations
De Zhang Lee, Han Fang and Ee-Chien Chang
Stateful Detection (SD) mitigates
adversarial attacks by determining whether a sequence of queries contains queries from a black-box adversary. Recent works, such as Blacklight and PIHA utilize query similarity to detect such queries. In this paper, we observe that temporal information, in particular, the temporal correlation of the classification soft labels, is a prominent characteristic of
adversarial attacks and can be leveraged to reduce false positive rates. Moreover, we point out a potential vulnerability in SD implementation. Many SD systems identify similar queries according to some implicit, computationally expensive metric. To improve efficiency, these systems often adopt an approximate similarity function as substitute. This discrepancy could be exploited by crafting queries that appear dissimilar under the approximation but are close in the intended metric, thereby evading detection. We refer to this as an “
adversarial attack” on the approximation function, and demonstrate it through a lightweight attack on Blacklight's similarity function. Based on the above observations, we propose a two-phase approach. The first phase identifies subsequences of queries with high similarity, incorporating randomness to prevent the aforementioned “
adversarial attacks”. The second phase analyzes temporal correlation of the soft-labels to further validate the presence of the adversary's queries. Experimental results show that the framework detects
adversarial queries generated by Boundary Attack, HSJA, SimBA, Square Attack with true positive rate (TPR) reaching 1.00, while maintaining a false positive rate (FPR) of at most 0.06. Additionally, the method is robust against OARS which is an adaptive attack.
Read the full abstract ▾
Cryptography and Security
A Longitudinal Study of Android Apps Signing Key Protection
Mark Huasong Meng, Qing Zhang, Weirao Lu et al. (+1 more)
Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected from major stores and OEM system images. Our analysis identifies 5,673 compromised keystores on GitHub and 26 unique certificates linked to 278 real-world apps. These include 26 third-party apps in public app stores and 252 preinstalled apps from seven manufacturers, collectively affecting over 10 billion users. We demonstrate the practical exploitability of these leaks through a proof-of-concept app replacement attack and identify spillover risks in non-smartphone platforms, including a popular automotive head-unit platform installed in over 1,100 vehicle models. Our results reveal that signing-key mismanagement is a systemic risk, underscoring the need for a more rigorous key-management support in Android release engineering and distribution infrastructures.
Read the full abstract ▾
All authors Mark Huasong Meng, Qing Zhang, Weirao Lu, Chunyang Chen
Cryptography and Security
Evaluating LLMs for Real-World Web Vulnerability Detection
Sebastian Neef, Luca Jungnickel, Antonio Benjamin Buchholz et al. (+2 more)
Large
Language Models (LLMs) have emerged as a promising tool for automated vulnerability detection, yet their effectiveness on web-specific vulnerabilities remains to be explored. This work
benchmarks six frontier (Claude Opus 4.6, Codex GPT-5.4, Gemini 3.1-pro-preview) and open-weight models (Qwen 3.5, Qwen 3 Coder Next, MiniMax M2.5) on their ability to detect real-world web vulnerabilities using static analysis in WordPress plugins, including SQL injection, stored cross-site scripting, path traversal, and remote code execution. Using five
prompt designs of varying structure, scope, and complexity across three experiment iterations, we aim to answer how model and
prompt choice affects vulnerability detection. Our results show that all models are capable of detecting valid security issues, but the detection rate varies depending on the model and
prompt. For example, Claude Opus 4.6 achieved the highest web vulnerability detection rate (63%), while open-weight MiniMax M2.5 performs on par with other frontier models (48%), and self-hosted Qwen 3.5 only achieved 35%. We show that scoped
prompts that narrow the vulnerability scope outperform open-ended ones, whereas the
prompt complexity has little impact. Surprisingly, no model achieved full reporting consistency across three experiment iterations, with some as low as 50%. Our experiments demonstrate the opportunities and limits of LLM-based vulnerability detection, as no model correctly identified one baseline vulnerability in one of the plugins. Additionally, we derive practical lessons learned for security practitioners and publish all code and data to support future research.
Read the full abstract ▾
All authors Sebastian Neef, Luca Jungnickel, Antonio Benjamin Buchholz, Valene Spence, Vicente Birke Gonzalez
Cryptography and Security
From Production SIEM to Reusable Cybersecurity Artifacts
Sidnei Barbieri, Leonardo Vaz de Meneses, Ágney Lopes Roth Ferraz et al. (+2 more)
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inaccessible because raw logs cannot be released; as a result, research relies on synthetic or dated
datasets. We treat the boundary between private production telemetry and reusable research artifacts as the design object: a methodology that extracts, anonymizes, structures, and validates Security Information and Event Management (SIEM) data from a production financial SOC while preserving task-relevant investigative structure within a declared
privacy boundary. Two consumers stress the same artifact. As training material, it fails loudly: 37 MITRE ATT&CK-mapped HIKARI challenges work only when anonymization preserves temporal order and entity consistency. As a measurement substrate, it fails quietly: across 200 SOCpilot incidents, a deterministic verifier detects non-compliant Large
Language Model (LLM) actions that are absent from the human baseline. The result is a measurable
privacy-utility boundary rather than a formal anonymity claim.
Read the full abstract ▾
All authors Sidnei Barbieri, Leonardo Vaz de Meneses, Ágney Lopes Roth Ferraz, Wagner Comin Sonaglio, Lourenço Alves Pereira Júnior
Cryptography and Security
ARENA: An Architecture for Measuring the Transferability of Autonomous Cyber Defense
Sidnei Barbieri, Ágney Lopes Roth Ferraz, Wagner Comin Sonaglio et al. (+3 more)
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inaccessible because raw logs cannot be released; as a result, research relies on synthetic or dated
datasets. We treat the boundary between private production telemetry and reusable research artifacts as the design object: a methodology that extracts, anonymizes, structures, and validates Security Information and Event Management (SIEM) data from a production financial SOC while preserving task-relevant investigative structure within a declared
privacy boundary. Two consumers stress the same artifact. As training material, it fails loudly: 37 MITRE ATT&CK-mapped HIKARI challenges work only when anonymization preserves temporal order and entity consistency. As a measurement substrate, it fails quietly: across 200 SOCpilot incidents, a deterministic verifier detects non-compliant Large
Language Model (LLM) actions that are absent from the human baseline. The result is a measurable
privacy-utility boundary rather than a formal anonymity claim.
Read the full abstract ▾
All authors Sidnei Barbieri, Ágney Lopes Roth Ferraz, Wagner Comin Sonaglio, Gioliano de Oliveira Braga, Henrique Curi de Miranda, Lourenço Alves Pereira Júnior
Cryptography and Security
Beyond Classification Accuracy: An Exploration-Range Evaluation of Adaptive Crawling for Fake Shopping Sites
K. Karasawa, K. Takeshige, S. Matsugaya et al. (+2 more)
In recent years, fake shopping sites targeting Japanese users have appeared in the top results of search engines through SEO poisoning, causing increasing damage. Conventional collection methods rely on fixed keywords and cannot keep up with evolving attack campaigns, delaying the discovery of new sites. We propose a closed-loop crawler that incorporates the page-level outputs of a fake-site classifier (fastText+LightGBM) into the search queries of the next cycle. Search queries are generated by a seed-compound strategy that combines characteristic words extracted from positive pages with seed words from the fake-shopping context (e.g., “deep discount,” “official”). To complement evaluations that tend to focus on classifier accuracy, we also introduce per-cycle new-host counts and cumulative unique-host counts as exploration-range metrics. In a comparative experiment ($n=3$ for the proposed method, $n=2$ for the baseline), the fixed-keyword baseline yielded zero new-host acquisition from cycle 2 onward, indicating complete stagnation, whereas the proposed method continued to discover new hosts and, at cycle 3, achieved a cumulative unique-host count approximately 7.6 times that of the baseline on average.
Read the full abstract ▾
All authors K. Karasawa, K. Takeshige, S. Matsugaya, M. Shimamura, M. Hashimoto
Cryptography and Security
LLM-assisted Generation of Pseudo-C2 Servers for IoT Malware Dynamic Analysis
K. Hasui, S. Matsugaya, M. Shimamura et al. (+1 more)
Most IoT malware operates as botnets dependent on Command and Control (C2) servers, but the short-lived nature of attack infrastructure often leaves samples dormant without C2 communication, hindering dynamic analysis. This paper proposes a system that combines Ghidra with a Large
Language Model (LLM) to extract communication specifications from a malware binary and automatically generate a pseudo-C2 server. Experiments using Mirai demonstrate that the proposed system semantically interprets binary control structures and extracts all 20 core protocol elements in agreement with the ground truth (100% specification extraction accuracy). The generated pseudo-C2 server fully reproduces seven of ten DDoS attack vectors with attack behavior consistent with the original C2. When applied to a customized variant created by modifying the publicly available Mirai source code, the method succeeds end-to-end – from specification extraction through pseudo-C2 generation to attack reproduction – demonstrating that the LLM infers specifications from binary structures without relying on pre-trained knowledge. This approach extends the applicability of LLMs from analysis assistance to the automated construction of dynamic analysis environments.
Read the full abstract ▾
All authors K. Hasui, S. Matsugaya, M. Shimamura, M. Hashimoto
Cryptography and Security
"What Happens Locally, Leaks Globally": Detecting Privacy Leakage Risks in MCP Servers
Biwei Yan, Minghui Xu, Yijun Yang et al. (+4 more)
The Model Context Protocol (MCP) has rapidly become the de facto standard for connecting large
language models (LLMs) to external resources, but it also introduces a class of
privacy risks that existing tools are ill-equipped to detect. Unlike conventional exfiltration bugs, leakage in MCP servers is largely protocol-induced: credentials, API keys, and Personally Identifiable Information (PII) cross the local/LLM boundary simply by being returned, logged, or raised inside a tool handler, with no explicit outbound request in the source code. We present MCPPrivacyDetector, a context-aware cross-
language static analysis framework that detects such leakage in
multilingual MCP servers. MCPPrivacyDetector lifts heterogeneous code implemented across different programming
language (e.g., Python) into a unified program representation, applies context-aware semantic filtering to isolate genuinely sensitive values and protocol-specific implicit sinks (e.g., @mcp.tool handlers), and performs taint analysis to enumerate feasible flows. Applied to 10,655 real-world MCP servers, MCPPrivacyDetector finds leakage rates above 10%. Case studies confirm concrete exposures including leaked Bearer
tokens, propagated API keys, and plaintext authentication credentials, arguing for systematic, protocol-aware safeguards in the emerging LLM
agent toolchain.
Read the full abstract ▾
All authors Biwei Yan, Minghui Xu, Yijun Yang, Boyang Ma, Xuelong Dai, Jingku Li, Yue Zhang
Cryptography and Security
Differential Zonotopes for Verifying Global Robustness of DNNs
Anagha Athavale, Samuel Teuber, Matteo Maffei et al. (+3 more)
The robustness of deep neural networks (DNNs) is critical in security-sensitive applications, where small input perturbations should not alter model predictions. This property is commonly formalized as local or global robustness: the former considers perturbations around a single input, while the latter – strictly stronger – quantifies over all input pairs. While local robustness can be expressed as a safety property, global robustness is a 2-safety property, making it substantially more challenging to verify. We present a novel static analysis technique for verifying the global robustness of DNNs. Our approach is based on differential
halo zonotopes, a new abstract domain that extends zonotopes to jointly propagate pairs of perturbed inputs in lock-step while tightly bounding their divergence. In addition, we introduce a symmetric variant of confidence-based global robustness that disregards perturbations leading to differing but low-confidence predictions. This relaxation yields a practically meaningful notion of robustness that applies to a broader class of networks. We implement our approach in a new tool, called TwoSafe, and evaluate it on standard DNN verification
benchmarks, including widely deployed models. Our results show that TwoSafe significantly outperforms the state of the art in both precision and scalability, enabling the verification of networks an order of magnitude larger than those handled by prior techniques.
Read the full abstract ▾
All authors Anagha Athavale, Samuel Teuber, Matteo Maffei, Ezio Bartocci, Dejan Nickovic, Georg Weissenbacher
Cryptography and Security
DIPBox: A Multi-scale Testing Framework for Tracking Dataset Regeneration
Tian Dong, Yan Meng, Shaofeng Li et al. (+5 more)
Training
datasets have tremendous proprietary value and are vulnerable to unauthorized copying. Existing defenses mainly focus on tracking individual data points, but pay little
attention to the threat of
dataset regeneration. Through a measurement study of public tumor
datasets, we identify substantial real-world partial-
dataset replication, raising concerns about potential license noncompliance. To counter the challenge of tracking previously unknown
adversarial regeneration, our key insight is that regeneration that preserves model utility inevitably preserves measurable signals across multiple feature scales. We categorize these
dataset features into sample-, set-, and distribution-level features and design four similarity metrics to accurately identify regeneration. Based on these metrics, we develop DIPBox, which to our knowledge is the first testing framework that tracks regeneration suspects via multi-scale similarity testing across a spectrum of defender access settings, from limited to full information. We further provide a learning-theoretic analysis that justifies these multi-scale metrics and formalizes an inherent utility–divergence trade-off, implying fundamental limits on evasive regeneration. Extensive experiments on 16
vision and text base
datasets, 320 regenerated
datasets, and 590 derived models validate that DIPBox outperforms previous solutions while characterizing its robustness and limits under three adaptive attacks.
Read the full abstract ▾
All authors Tian Dong, Yan Meng, Shaofeng Li, Guoxing Chen, Yuling Chen, Zhen Liu, Haojin Zhu, Hao Chen
Cryptography and Security
Impact Analysis of Speech Representation Learning Models for Acoustic Side-Channel Attack
Nitin Choudhury, Bikrant Bikram Pratap Maurya, Arun Balaji Buduru et al. (+1 more)
Acoustic side-channel attacks (ASCA) on keyboards have gained increasing
attention, yet impact of
speech representation learning models in ASCA remains unexplored. Addressing this, we introduce KEYAC, a
dataset designed to analyze representation generalization for ASCA under both standard and VoIP codec settings. On KEYAC, we evaluate six representation learning models under zero-shot and partial fine-tuning settings using fully connected and convolutional networks. Results show that while partial fine-tuning improves performance, models struggle to generalize across VoIP codecs. We hypothesize this limitation stems from inadequate modeling of nonlinear feature interactions in conventional fine-tuning architectures. To address this, we employ Kolmogorov-Arnold Networks (KAN) for fine-tuning. Empirical results show that KAN-based fine-tuning consistently outperforms the baselines and establishes a new state-of-the-art on KEYAC.
Read the full abstract ▾
All authors Nitin Choudhury, Bikrant Bikram Pratap Maurya, Arun Balaji Buduru, Orchid Chetia Phukan
Cryptography and Security
AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents
Zhen Zhao, Yu Zhang, Yanpeng Zhu et al. (+4 more)
Traditional OS security models based on "resource exposure plus permission checks" face structural challenges as LLM-driven autonomous
agents acquire capabilities for planning, tool use, network access, and code execution. Once an
agent runtime is compromised through
prompt injection or malicious tool outputs, an attacker can compose POSIX-style resource primitives into behaviors far beyond the user's task authorization. To address this, we propose AgenticOS, an intent-oriented secure OS architecture that consolidates delegable, auditable software capabilities into OS-native ones rather than replacing all applications. The core insight is to reframe the OS from a "resource manager" into an "intent filter": instead of requesting low-level resources directly,
agents submit structured intent declarations, from which the system synthesizes a least-privilege environment with mandatory mediation,
auditing, and information-flow constraints. At the implementation level, we introduce a four-layer architecture – Ghost Kernel, Logic Shutter,
Agent Capsule, and Semantic Boundary Gateway – together with the Intent ABI, Manifest-Only Runtime, Weaver-based capability generation, and an admission model for AgenticOS-native Skills.
Read the full abstract ▾
All authors Zhen Zhao, Yu Zhang, Yanpeng Zhu, Jia Wang, Songqiao Tao, Xin Cheng, Jiexin Gao
Cryptography and Security · Cross-listed from cs.LG
Enhancing Differentially Private Mechanisms via Empirical Bayes
Minwoo Kim, Junyong Park and Sungkyu Jung
Differential
privacy (DP) has become the gold standard for ensuring the
privacy protection of machine learning and statistical
algorithms in recent decades. A plethora of
algorithms and methods have been developed to enhance the utility of DP
algorithms while maintaining the same level of DP. However, these are often overly complex or computationally ineffective. We propose a novel approach focusing on denoising the output of the simple additive Gaussian mechanism by adopting the idea of empirical Bayes estimation. We highlight that the empirical Bayes approach can reduce the mean-squared error solely by taking the output of the Gaussian mechanism as input. Our numerical studies show that this simple yet powerful approach can be applied to improve upon various statistical problems, including histogram release, principal component analysis, and linear regression, often outperforming existing private
algorithms.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CL
Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations
Chenhui Hu, Muhammed Salih, Sudipto Guha et al. (+1 more)
Multi-turn jailbreaks can evade turn-level moderation by spreading unsafe intent across a dialogue through gradual escalation, reframing, and role manipulation. We address multi-turn jailbreak detection as a conversation-level classification problem and introduce an efficient hierarchical detector that avoids expensive long-context concatenation while retaining cross-turn
reasoning. The model encodes individual turns to form compact turn representations and applies a lightweight conversation module that captures dialogue dynamics and selectively attends to fine-grained evidence when needed. On a challenging evaluation
benchmark of 14,038 conversations, our approach achieves an F1 of 0.9394, outperforming Claude Opus 4.7, the strongest competing baseline, by 0.07 while halving its false-positive rate. Ablation studies confirm that each architectural component contributes meaningfully, with combining cross-
attention and self-
attention in the conversation module yielding a 2.26 percentage point reduction in false-positive rate over the self-
attention-only variant.
Read the full abstract ▾
All authors Chenhui Hu, Muhammed Salih, Sudipto Guha, Subramanian Srinivasan
Cryptography and Security
OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization
Jerry Wang, Hsin-Ling Hsu, Yi-Cheng Lai et al. (+2 more)
Production LLMs increasingly rely on toxicity-based moderation filters as a primary defense, assuming that harmful intent correlates with toxic surface wording. We show this assumption is fundamentally brittle: surface toxicity and
adversarial intent can be decoupled by replacing as few as five
tokens. We present OTTER (Obfuscated Toxicity-Evading
Token Evolution for Rewriting), a black-box red-teaming framework requiring only standard API access, directly targeting the practical constraints of industry security audits. Evaluated on 457 AdvBench
prompts across four GPT models, OTTER raises average ASR from 7.0% to 84.0%. We further provide the first quantitative analysis of the toxicity–bypass relationship and a per-category breakdown, translating our findings into actionable recommendations for classifier hardening in production deployments.
Read the full abstract ▾
All authors Jerry Wang, Hsin-Ling Hsu, Yi-Cheng Lai, Nai-Chia Chen, Fang Yu
Cryptography and Security
Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer
Zhengsong Zhang, Zongze Li, Jiawei Guo et al. (+1 more)
Local LLM
agents such as OpenClaw and Nanobot run on end-user machines and act on host resources - the shell, filesystem, browser, stored credentials, and messaging applications - through natural-
language goals. These
agents have become privileged software runtimes that mediate between user intent, model outputs, and host-level actions. Existing research characterizes the landscape through
prompt injection, malicious skills, marketplace risks, or black-box evaluation of
agents. But the implementation layer that performs this mediation, the
prompt builder, parser, tool dispatcher, skill loader,
memory writer, network client, and permission gate, has remained an unexamined safety boundary. To our knowledge, no prior work has examined the
agent's source tree to audit these components for implementation-level security weaknesses. We present CLAWAUDIT, a static
auditing framework for measuring vulnerability exposure in local LLM
agent runtimes. CLAWAUDIT derives a five-category vulnerability taxonomy from STRIDE and develops custom static-analysis rules that target
agent-specific patterns absent from established rule sets for vulnerability analysis. We instantiate the taxonomy in two backends, 47 Semgrep YAML rules and 30 CodeQL queries, and evaluate on OPENCLAWBENCH, a
benchmark of 446 source-code-level advisories from the OpenClaw repository and split temporally into 229 rule-derivation (train) and 217 held-out (test) advisories. On the held-out test, CLAWAUDIT raises Semgrep recall from 21.7% (Pro baseline) to 66.8%, and CodeQL recall from 13.8% (security-extended) to 75.1%. Train/test gaps remain within 4 percentage points for all four configurations, indicating that the rules generalize to vulnerabilities unseen during rule writing. A preliminary live-code audit shows that these recall-oriented rules require manual triage, motivating semantic filtering before production deployment.
Read the full abstract ▾
All authors Zhengsong Zhang, Zongze Li, Jiawei Guo, Haipeng Cai
Cryptography and Security
Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers
Zhenyu Ren, Yanbo Zhang, Boya Liu et al. (+1 more)
Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE). This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices. We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware. Snatcher identifies vulnerabilities in unencrypted BLE advertisements, unauthenticated acoustic triggers, and slow MAC address randomization. Through three levels - sound-based direction finding, RSSI-IMU sensor-fusion
navigation, and spatial-temporal clustering - our Android-based platform physically tracks and locates lost Apple accessories and devices in real-world tests. Our results highlight a crucial conflict between
privacy protection, anti-stalking design, and physical security, urging Apple to strengthen Find My defenses.
Read the full abstract ▾
All authors Zhenyu Ren, Yanbo Zhang, Boya Liu, Mo Li
Cryptography and Security
A Blockchain Consensus Mechanism for Distributed Electricity Trading
Shanglin Yang, Guo Chen and Shiping Chen
Distributed power systems complement centralized grids by coordinating distributed energy resources (DERs) to achieve regional energy self-sufficiency. Scaling such systems raises four persistent challenges: decentralized coordination, fair economic settlement, trustworthy operation, and system optimization, all without a central authority. This paper proposes Proof of Energy (PoE), a blockchain consensus mechanism that addresses these challenges through cryptographically secured, contribution-proportional node selection. In PoE, block generation rights are tied directly to real-world energy contributions, enabling distributed consensus without centralized dispatch. An Energy Contribution Unit (ECU) model is introduced to map heterogeneous energy services onto a unified value metric via scarcity-weighted normalization. A Verifiable Random Function (VRF)-based proposal mechanism then ensures selection probability is strictly proportional to node contribution, preserving
fairness and resisting manipulation. Case studies validate PoE across three dimensions: grid coordination, incentive
fairness, and optimization efficiency. The result is a cryptographically secured, incentive-compatible framework for decentralized value distribution in energy systems.
Read the full abstract ▾
Cryptography and Security
DEFENGRAPH: Knowledge Graph-Enhanced LLMs for Blue Team Cyber Defense
Zhen Wang, Kristen Moore, Qin Wang et al. (+7 more)
Large
Language Models (LLMs) show promise for supporting decision-making in cybersecurity, but their reliability in high-stakes, time-evolving environments remains limited due to
hallucinations, poor temporal
reasoning, and shallow grounding in system context. We introduce DEFENGRAPH, an LLM-driven assistant designed to support human defenders during cybersecurity incidents. DEFENGRAPH improves contextual
reasoning by integrating a dual-layer Static-Dynamic Knowledge Graph (KG) with graph-based path
retrieval, LLM-driven contextual filtering, and
reasoning-based re-ranking. The framework grounds LLM outputs in both long-term domain knowledge and evolving event context, enabling faithful and temporally aware decision support. We evaluate DEFENGRAPH in a cyber defense setting using knowledge graphs constructed from heterogeneous security artifacts, including SIEM alerts, system
topology, attacker behaviors, and prior defensive actions. The evaluation uses data collected during live Red vs. Blue team cyber range exercises simulating attacks on critical infrastructure, which generate realistic and noisy
datasets reflecting real-world defender workflows and system dynamics. Evaluations across four prevalent LLMs show that DEFENGRAPH sets a new state-of-the-art: on GPT-4o it boosts
reasoning-recall from 61.45% to 73.49% and ticket-action recall from 52.17% to 72.46% (precision 24.49% to 29.24%), with similar gains on LLaMA-3 (46.99% to 61.45%), DeepSeek-R1 (45.78% to 56.63%) and QWen-3 (51.81% to 59.04%), while surfacing up to 50 correct defense actions versus 36 for the next best baseline and holding fault rates steady.
Read the full abstract ▾
All authors Zhen Wang, Kristen Moore, Qin Wang, Guangsheng Yu, Minjune Kim, Diksha Goel, Gang Li, Ahmed Ibrahim, Ahmad Mohsin, Helge Janicke
Cryptography and Security · Cross-listed from cs.SD
Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning
Yongbin Huang, Xihao Xie and Jia Zhang
Speech Emotion Recognition (SER) systems increasingly leverage self-supervised acoustic representations, yet their vulnerability to training-time attacks remains largely underexplored. This paper presents the first systematic study of poisoning-based
backdoor attacks on SER, with a focus on threats enabled by text-to-
speech (TTS) generated audio. We introduce a stealthy, low-energy acoustic trigger that can be embedded imperceptibly into both natural and synthetic
speech, enabling scalable and consistent poisoning. Our experiments demonstrate that SER models can be reliably compromised with high attack success rates under low poisoning ratios, while maintaining near-clean performance on benign inputs. We further show that
backdoor patterns exhibit strong cross-model transferability and that self-supervised representations are particularly susceptible to learning these triggers. These findings reveal that TTS technology dramatically lowers the barrier to effective
backdoor attacks, exposing critical vulnerabilities in modern SER pipelines and motivating the urgent need for dedicated defenses.
Read the full abstract ▾
Cryptography and Security
OVIG: Optimistic Verification of AI Training Integrity via Gradient Signals
Hongxu Su, Jianzhu Yao, Huan Zhang et al. (+2 more)
The rapid growth of AI has increased the demand for domain-specific models. Post-training of open-source models offers a more economical way to meet this growing demand, but the cost of accelerator infrastructure often pushes organizations to outsource the process to third-party providers. An untrusted provider may deviate from the declared training procedure to save computation or inject malicious behavior. A potential solution is to audit the training by having an independent verifier replay the training and compare the results. This faces two key challenges: benign numerical drift from floating-point computation across heterogeneous accelerators is difficult to distinguish from malicious deviations, and the checkpoints and metadata required for verification introduce substantial storage and transmission costs. Existing approaches either have security limitations or high deployment costs. We present OVIG, an optimistic verification framework that verifies training using an empirical boundary on gradient differences calibrated from honest heterogeneous replay. Gradient differences that exceed this boundary are treated as malicious deviations. OVIG further uses optimistic verification and partitions training into stride-$s$ intervals, retaining evidence only at interval endpoints to reduce storage and transmission costs. Across shortcut training attacks and adaptive targeted manipulation attacks, OVIG maintains \(0\%\) ASR on
language,
vision, and
diffusion workloads. On Qwen3, increasing the stride from \(s=1\) to \(s=2000\) reduces off-chain storage and evidence transmission by \(1996\times\) while preserving \(0\%\) ASR and only adds \(14.3\%\) system computation overhead relative to unverified training.
Read the full abstract ▾
All authors Hongxu Su, Jianzhu Yao, Huan Zhang, Xuechao Wang, Pramod Viswanath
Cryptography and Security
Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers
Kerri Prinos, Lilianne Brush and Cameron Denton
The empirical foundation of cyber deception relies on human-centered hypotheses, but the rapid emergence of autonomous, AI-enabled attackers challenges whether this foundation transfers to AI
agents. To address this, we introduce an automated evaluation framework adapted from the Honeyquest instrument to assess LLM attacker judgment at scale. Our 21-LLM cohort spanned 10 providers, diverse architectures and specializations, open- and closed-weight models, and parameter scales from 8B to over 1T. We evaluated the performance of this LLM cohort (yielding 10,962 responses) against the 47-participant human baseline across an identical set of 174 reconnaissance queries. Our empirical evaluation reveals three key findings that establish LLMs as a distinct attacker class: (1) every model in our cohort falls for deceptive traps at a significantly higher rate than human attackers; (2) the defensive
attention-diversion effect observed in humans is statistically absent in our LLM cohort; and (3) a critical recognition-action gap, where LLMs successfully articulate trap recognition in their
reasoning but exploit the deceptive elements anyway 73.4% of the time; 48.5% of aware-on-deceptive responses correctly identify the trap and exploit it anyway, while 24.8% exploit after misidentifying the deceptive line. Across the 21 models, trap recognition in
reasoning text did not predict fell-for-trap behavior (Spearman $r = +0.08$, $p = 0.73$). Ultimately, these findings demonstrate that human-centered deception hypotheses do not reliably transfer to AI attackers, highlighting the critical need for new research into AI-native active defense frameworks.
Read the full abstract ▾
Cryptography and Security
Quantifying the Impact of Stealthy BLE Spam & Flooding Attacks on IoT Environments
Usman Rauf, Adalynn Martinez and Fadi Mohsen
The energy-efficient design of the BLE protocol, emphasis on rapid, and userfriendly discovery, making it an ideal choice for IoMTs, specifically, military field medical systems, and battlefield wearable sensors. Especially in active conflict zones, when static medical facilities are vulnerable and often targeted, limiting their viability for sustained care delivery. This rapid deployment, and ease of management comes at the cost of expanded attack surface, i.e., BLE flooding attacks. During such attacks, adversaries flood advertisement channels with unauthorized connection or advertising requests to exhaust nearby device resources and disrupt legitimate communication, sometimes culminating in denial-of-service conditions. A first public proof-of-concept of such attacks, using a Raspberry Pi has since been adapted to commodity platforms (e.g., Flipper Zero, HackRF, Android), lowering the barrier to attack. In contested environments, such platforms are directly relevant to
adversarial RF jamming and spoofing operations, where low-cost, portable devices can induce disproportionate disruption in dense wireless ecosystems. In this work, we develop a quantitative foundation for understanding the impact of such attacks and propose a practical deterrence strategy based on agility to raise the cost of such attacks.
Read the full abstract ▾