Cryptography and Security
ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems
Om Narayan, Rashmi Jyoti and Ramkinker Singh
The Model Context Protocol (MCP) is an open-source standard that allows AI
agents to connect to external tools, databases, and services. While this connectivity enables powerful
agent capabilities, it also introduces multi-step attacks that existing per-call defenses cannot reliably detect. Attackers can compose individually benign tool invocations into malicious sequences that evade isolated inspection. This paper presents ChainWatch, a sequential detection framework for identifying multi-step attacks in MCP-based AI
agent systems. ChainWatch models attack progression using a six-stage kill chain and applies a Hidden Markov Model (HMM) to classify tool-call sequences. Detection rules are triggered when a session exhibits suspicious progression across multiple stages. The framework is supported by a structured threat model covering direct sequential attacks, indirect
prompt injection chains, and hybrid multi-stage attacks. A 20-dimensional feature extraction schema captures behavioral signals from tool interactions. We demonstrate the approach using five representative attack scenarios from the security literature, showing how ChainWatch detects attack chains that evade traditional per-call security mechanisms.
Read the full abstract ▾
Cryptography and Security
ChannelGuard: From Borrowed Safety to Application-Controlled Defenses in Multi-Agent LLMs
Elias Hossain, Md Mehedi Hasan Nipu, Fatema Tuj Johora Faria et al. (+4 more)
AI assistants increasingly work as teams, where one model makes a plan, others search the web, use tools, or read stored information, and another writes the final answer. This creates new security risks because harmful instructions can enter through information passed between models, not just through the user's message. Yet safety tests usually report only whether an attack succeeded, without showing what actually stopped it. We show that systems with similar safety scores can depend on very different protections. Across five
agent models, attacks were stopped by a cloud provider's filter, by the model itself, or by inconsistent model behavior. This matters because protection that comes from the model or provider may disappear when either one changes. We introduce CHANNELGUARD, an application-controlled defense that checks information at each handoff without extra training or additional model calls. Across more than 5,700 test runs, it stopped all tested attacks hidden in tool outputs on all five models. On two open models, it reduced successful
prompt attacks from 80% to 3% and from 77% to 10%, with no change in accuracy on 30 math problems. However, reworded attacks could still bypass the defense.
Read the full abstract ▾
All authors Elias Hossain, Md Mehedi Hasan Nipu, Fatema Tuj Johora Faria, Shubhashis Roy Dipta, Maleeha Sheikh, Tasfia Nuzhat Ornee, Niloofar Yousefi
Cryptography and Security
JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models
Qingjia Huang, Jingyu Zhang, Jianguo Wu et al. (+6 more)
The assessment of jailbreak attacks against large
language models currently suffers from inconsistent evaluation criteria and methods, leading to unreliable estimates of attack success rates. We propose JailMeter, an evidence-based evaluation framework designed to more faithfully measure jailbreak effectiveness. Inspired by the Information Bottleneck theory, JailMeter applies dual-feedback optimization to filter jailbreak noise from model responses while preserving content relevant to the original malicious question. This process produces concise evidence for a rigorous assessment under which an attack is validated only when the response captures the malicious intent and delivers a complete answer, thereby signaling a substantive bypass of model safety
alignment. We evaluate JailMeter on JailMeter-Eva, a challenging
benchmark containing 330 human-labeled, non-rejected jailbreak instances. JailMeter achieves an accuracy of 97.27%, substantially outperforming existing evaluation methods. To support large-scale evaluation, we further distill JailMeter into a small
language model, JailMeter\textsubscript{SLM}, which maintains comparable reliability with significantly reduced computational costs. Code and
dataset are available at https://github.com/Magi2B0y/JailMeter.
Read the full abstract ▾
All authors Qingjia Huang, Jingyu Zhang, Jianguo Wu, Yakai Li, Weijuan Zhang, Yankai Rong, Junyi Yao, Shengzhi Zhang, Xiaoqi Jia
Cryptography and Security
RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery
Muxi Lyu, Karen Shieh, Yiwei Hou et al. (+3 more)
Cross-Site Scripting (XSS) remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding
agents offer a promising approach to XSS discovery by combining source-code
reasoning with interactive testing against a running application. However, a coding
agent's claims cannot be trusted on their own. We characterize three reward-hacking behaviors in white-box agentic XSS discovery and propose three requirements that an ideal verifier should meet. We present RECEIPT, a verification framework that makes
agent-reported XSS findings trustworthy by enforcing environment isolation, PoC constraints, role separation, and verdict binding. Each confirmation therefore establishes two properties: the script runs in a real browser, and the payload was planted under the attacker role and executed in the victim role's browser. This constrained replay procedure makes validation deterministic and reproducible. We evaluate RECEIPT on 95 real-world web-application targets drawn from popular open-source projects. Within a $20 per-application budget, RECEIPT found 24 previously unknown XSS vulnerabilities, 12 of which have already been acknowledged by maintainers after responsible disclosure, and recovered the labeled CVE in 36% of known-vulnerability recovery targets. Compared with the same
agent using self-judgment and with black-box scanners, RECEIPT confirms more real exploits while admitting no false positives.
Read the full abstract ▾
All authors Muxi Lyu, Karen Shieh, Yiwei Hou, Hao Wang, Koushik Sen, David Wagner
Cryptography and Security · Cross-listed from cs.AI
Attacking Graph Foundation Models Through Their Shared Representation
Pankaj Kumar and Subhankar Mishra
A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task
reasoning. We call this map the
alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text
embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an
alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the decoder. A realizable input-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak. How much of this fragility an input-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder's local Lipschitz sensitivity, and report clean-accuracy headroom as a within-model ordering heuristic that does not survive on realizable attacks.
Read the full abstract ▾
Cryptography and Security
CryptanalysisBench: Can LLMs do Cryptanalysis?
Lukas Fluri, Avital Shafran, Nicholas Carlini et al. (+5 more)
Cryptanalysis - the task of finding attacks against cryptographic schemes - sits at the intersection of mathematical
reasoning and cybersecurity, two areas where LLMs have advanced fastest. Cryptanalysis represents both a clean testbed for frontier
reasoning (as practical attacks can be automatically verified) and a domain with unusually high stakes, since the primitives under study underpin our digital security. In this paper we ask whether LLMs can do cryptanalysis, and find that the answer is increasingly yes. We introduce CryptanalysisBench, 191 tasks across six families of cryptographic primitives (block ciphers, hash functions, etc.) drawn primarily from four NIST standardization competitions. Our
benchmark consists of three tiers: (i) primitives with known practical breaks; (ii) primitives with no known practical break, evaluated both at full strength and as scaled-down variants; and (iii) a challenge set of production primitives at the frontier of cryptanalysis. Five frontier models (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and the open-weights GLM 5.2) break 65%-86% of Tier 1 schemes, 6-12 Tier-2 schemes at full strength, and 24-61 across all scaled-down variants. Beyond deriving known results, models produce novel cryptanalysis, such as a key-recovery attack that exploits a design flaw in the SpoC AEAD and an error in KINDI's published CCA-security proof, both to the best of our knowledge not previously known. We release CryptanalysisBench as a tool to help track if (or when) AI cryptanalysis becomes a serious factor and as a scaffold for stress-testing candidate schemes before deployment. The attacks that the
benchmark already surfaces are an early snapshot of a fast-moving frontier that may soon match, and in places exceed, the published state of the art.
Read the full abstract ▾
All authors Lukas Fluri, Avital Shafran, Nicholas Carlini, Matthew Jagielski, Milad Nasr, Orr Dunkelman, Eyal Ronen, Florian Tramèr
Cryptography and Security · Cross-listed from cs.AR
PIP-NTT: Towards a Scalable Memory-Parallelized Accelerator for Iterative NTT in PQC
Malik Imran, Ayesha Khalid, Ciara Rafferty et al. (+3 more)
The iterative forward and inverse number theoretic transform (NTT) is a key component in
lattice-based post-
quantum cryptography (PQC), typically implemented using Cooley-Tukey and Gentleman-Sande butterfly units. Existing iterative NTT accelerators often rely on ping-pong
memory schemes and large
memory blocks tied to the cyclotomic ring, which limits overall efficiency. To overcome this, we propose a
memory-parallelization strategy using four smaller n/4-sized
memories for ring size n, preserving the total
memory footprint of conventional designs. We also introduce a multiplication-free rescaling architecture for the inverse NTT. Building on these innovations, we perform a comprehensive hardware-based design space exploration of unified Cooley-Tukey and Gentleman-Sande butterfly units, evaluating both coarse- and fine-grained pipelining strategies. The resulting optimized butterfly unit forms the core of our proposed pipelined and
memory-parallelized NTT accelerator, "PIP-NTT". It integrates two such units alongside the
memory-parallelization scheme to boost computational throughput under tight area constraints. Experimental results on FPGA platforms show that PIP-NTT achieves 2.67x and 1.48x higher efficiency in average Area-Time Product compared to the most area-optimized and high-speed NTT accelerators in the literature. The design is scalable across butterfly radices and adaptable to other PQC schemes, making it a versatile solution for future cryptographic hardware
Read the full abstract ▾
All authors Malik Imran, Ayesha Khalid, Ciara Rafferty, Safiullah Khan, Muhammad Rashid, Maire O'Neill
Cryptography and Security
Semi-Automated Detection of Gaps in LLM Security Knowledge
Shufan Chai, Liangliang Sun and Jessica Staddon
Large
language models (LLMs) are increasingly used for a range of software, hardware and human-centered security tasks. Consequently, LLM performance on security tasks is an active area of measurement and research, often with a focus on identifying areas in which LLM security "knowledge" may be insufficient. Popular strategies for identifying LLM security knowledge gaps include building corpora of challenge questions or task
benchmarks, strategies that require substantial manual work and security expertise to design and execute. We introduce a partially-automated method for assessing LLM knowledge of a security area. The method uses authoritative information from Consumer Protection Agencies (CPAs) to identify instability in LLM responses that can be indicative of knowledge gaps. We demonstrate the method for 2 security topics, identity theft and impostor scams, and 5 LLMs in 2 leading LLM families, Gemini and GPT, using publicly available information about identity theft and impostor scams from 6 CPAs. The method distinguishes between models that have and don't have sufficient knowledge to accurately identify the security topics in text narratives.
Read the full abstract ▾
Cryptography and Security
Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing
Jie Li
Large
language model (LLM)
agents are starting to take on routine work in high-performance computing (HPC), including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an
agent commonly acts under its user's credentials and inherits the user's access to files and the scheduler. This arrangement creates a failure mode that ordinary account-level controls do not capture.
Adversarial instructions in a log, tool description, shared file, or peer-
agent message may redirect the
agent beyond the task the user assigned, even though every resulting command is authenticated and permitted for that account. We refer to this as the hijacked authorized
agent problem. Existing
agent-security studies explain relevant mechanisms, such as indirect
prompt injection and tool misuse, but generally evaluate them in web, enterprise, or personal-assistant settings. HPC security, by contrast, has mature controls for identity and isolation but does not ordinarily represent the intent of a particular task. This paper defines the threat model in the HPC setting, identifies attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows, and examines where current controls fall short. It concludes with a research agenda and a plan for an empirical
benchmark, TaskBound.
Read the full abstract ▾
Cryptography and Security
0-Cyclic Equalizability of Binary Words Characterized by Hamming Weight
Sarunyu Thongjarast
The random cut is one of the most fundamental shuffles in card-based cryptography: it rotates a sequence of face-down cards by a secret amount. Under this shuffle, two sequences of cards are indistinguishable if and only if they are cyclic shifts of each other. This motivates the question of whether, given two sequences of cards, inserting cards at matching positions can make them indistinguishable. A previous study shows that such an insertion is always possible when any cards may be inserted, as long as the two words are permutations of each other. This paper considers a stronger restriction: if the cards are binary, carrying only 0 or 1, can we insert only 0s to make the sequences indistinguishable? We call two words 0-cyclically equalizable if one can insert 0s into both sequences at matching positions so that the resulting words are cyclic shifts of each other. Our main result is that two binary words of equal length are 0-cyclically equalizable if and only if they have equal Hamming weight, that is, the same number of 1-bits. Since equal Hamming weight is clearly necessary, the content of the paper is to show that it is also sufficient. Our proof is constructive: we encode a pair of binary words as a single word over the four-letter alphabet {A, B, X, O}, reduce equalizability to a simpler condition in this encoding, and build the required insertion explicitly.
Read the full abstract ▾
Cryptography and Security
ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration
Chengheng Li-Chen and Kyuhee Kim
Regulatory regimes such as the EU AI Act mandate machine-readable marking of synthetic text, but existing watermark detectors rely on the generating LM and on heuristic thresholds with no closed-form calibration. We introduce ChainMark, an active watermark that partitions the vocabulary into S states via keyed SHA-256 and forces a hard Markov transition on a fraction rho of positions; the detector replays the partition from the same key in O(n) hash operations, with no LM access. We derive a closed-form S*(n, rho, alpha) mapping a target FPR, text length, and budget to the minimum state count (
Theorem 1), prove a universal robustness threshold delta* = 1 - 1/sqrt(2) approximately 29.3% that is invariant in (S, rho, n) (
Theorem 2), and generalise both to any k-regular transition
topology (
Theorem 3). Across three instruction-tuned LLMs and four domains, ChainMark strictly dominates KGW and SWEET under translation and random-substitution attacks at matched budget; a one-corpus empirical recalibration restores the 1% target FPR on natural-
language text.
Read the full abstract ▾
Cryptography and Security
Adversarial Robustness of Phishing Email Detection: A Comparative Study of TF-IDF + Logistic Regression and Fine-Tuned DistilBERT
Tanveer Ahmed and Seyedali Pourmoafil
Phishing emails remain one of the most persistent cybersecurity threats, and machine-learning classifiers are widely used to detect them. Most reported detection accuracies, however, are measured on clean, in-distribution test data rather than on emails deliberately altered to evade detection. This paper reports a controlled, pairwise comparison of two phishing-detection approaches a TF-IDF + Logistic Regression baseline and a fine-tuned DistilBERT
transformer trained on a unified corpus of 82,255 emails drawn from six public
datasets and evaluated under three conditions: normal in-distribution, synthetic phishing, and
adversarial phishing. Both models exceeded 98% accuracy on clean data yet degraded sharply under
adversarial testing: TF-IDF + LR fell to 64.00% (a 34.59-percentage-point drop) and DistilBERT fell to 63.64% (a 35.40-percentage-point drop) a gap of only 0.36 percentage points, equivalent to a single email in the 275-sample
adversarial test set. LIME, SHAP, and
attention-rollout analysis indicate the two models relied on different evidence yet showed similar vulnerability. Pairwise error analysis shows the models agreed on 54.9% of
adversarial samples but each made a similar number of exclusive errors (24 and 25 respectively), indicating partly complementary rather than identical failure modes. The results show that clean-data accuracy does not predict
adversarial robustness, and that
adversarial testing should be a standard part of phishing-detection evaluation.
Read the full abstract ▾
Cryptography and Security
HALLMARK: How to Diagnose LLM Citation Verifiers and When to Deploy Them
Kayoon Kim, Wieland Brendel and Patrik Reizinger
GPTZero found 53 NeurIPS 2025 accepted papers with hallucinated citations, and venues now screen submissions with automated reference checkers. Rule- and Large
Language Model (LLM)-based verifiers are emerging, but many are released without a shared evaluation and each flags a different kind of error, so it is unclear which to trust or when to deploy them. We address this with HALLMARK (
Hallucination benchmark): 2,526 BibTeX entries spanning 14
hallucination types, with per-type and diagnostic sub-test labels and further temporal, cross-domain, and real-world evaluation splits. We evaluate zero-shot and tool-augmented LLMs, a DOI-lookup baseline, and our own co-designed rule-based verifier, bibtex-updater. Verifiers can miss
hallucinations and wrongly flag correct papers, so every flag still needs human review. The false positive rate (FPR) determines the review effort and thus limits deployment. The tested models exhibit an order-of-magnitude spread in FPR; agentic lookups buy recall but inflate FPR, and neither smaller models nor
prompt optimization reach the frontier's operating point. A two-stage cascade with bibtex-updater avoids that inflation, providing an upper bound, given the co-design. These rankings, however, depend on what counts as a
hallucination: re-scoring the types that describe a real work cited inaccurately changes which verifier ranks first, and venues have not agreed on a definition. We call for a community definition and release per-type labels and a re-scoring protocol so that any agreed definition can be scored against every verifier.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.SE
A Decision-Centered Reference Architecture for Trustworthy Agentic Commerce
Dimitrios S. Sfiris
Agentic commerce extends agentic shopping into software
agents that interpret policy, prepare checkout, generate transaction-facing
language, and act under delegated payment authority. Protocols standardize external exchanges, but merchants still need one authoritative representation of commercial eligibility, actor authority, checkout validity, payment dispatch, generated claims, and evidence. This design-science study presents a protocol-agnostic architecture built around a canonical envelope, protected dependency and result hashes, Ed25519 or HMAC authentication, live-request rebinding, a seven-axis generated-claim gate, execution-time dependency revalidation, and eleven semantic invariants. Evaluation used an open-source JavaScript implementation, eight deterministic ecommerce scenarios, and five controlled ablations. Seven initially valid actions were permitted. After protected state changed, none could proceed without a fresh decision; a hostile-accessor case also remained blocked. Action status was consistent across configured surface-bound envelopes, and each scenario contained the three protected hashes and its targeted dependency reference. Each ablation produced the predicted unsafe regression when one safeguard was bypassed, while the protected path contained the same failure. The hostile accessor was read once, and the suite passed 66/66 tests, schema validation, and committed examples. Results support protected-dependency change detection, bounded outcome derivation, stale-decision prevention, surface-bound status consistency, refusal propagation, and verified-state identity under synthetic fixtures, but do not establish rule completeness, production security, performance, legal compliance, live interoperability, population error rates, or independent replication.
Read the full abstract ▾
Cryptography and Security
PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption
Sahaj Majavdia and Mahdi Taheri
Structured
pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces
Polynomial-Sensitivity-Aware
Pruning (PSAP), a structured
pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude,
polynomial activation sensitivity, and rotation cost, which concentrates
pruning in fault-tolerant regions. Across two architectures, two
datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5–14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi–Shoup rotations by up to 45.2% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.
Read the full abstract ▾
Cryptography and Security
Quantum Cryptanalysis on IBM Quantum Hardware: Extending Even–Mansour Period Recovery from $N=4$ to $N=10$
Taebong Kim, Youngsik Hong, Minsik Kim et al. (+4 more)
We report genuine-un-compiled, textbook-faithful-
quantum cryptanalysis of symmetric-cipher structures executed on real IBM
quantum hardware (ibm\_kingston, Heron generation). Using Simon's
algorithm we recover the hidden period of the Even-Mansour cipher up to security parameter N = 10 on real hardware, beyond the largest previously reported real-hardware key recovery of N = 4, and we cleanly recover the periods of a 3-round Feistel (DES-family) construction at block sizes 6 and 8; a 21-
qubit block-10 instance is verified in simulation and submitted to hardware. We further provide a breadth-first
benchmark of five genuine
quantum attacks spanning four symmetric-cipher design paradigms – Bernstein-Vazirani (linear structure, single query), Grover (SPN key search, quadratic), and Simon (Even-Mansour, CBC-MAC forgery, and Feistel; exponential-to-
polynomial in query complexity) – validated to the classical-simulation ceiling of 25
qubits. We are deliberately explicit about scope: these attacks target reduced or structured constructions in the Q2 (
quantum-query) model, asymptotically follow the birthday bound and therefore do not constitute
quantum advantage over classical collision-finding, do not break full AES/RSA or 16-round DES, and rely on error mitigation rather than fault-tolerant error correction. Our contribution is the real-hardware demonstration at record structure sizes, the breadth of genuine algorithmic coverage across four paradigms, and an honest, reproducible
benchmark with public artifacts.
Read the full abstract ▾
All authors Taebong Kim, Youngsik Hong, Minsik Kim, Sunyoung Choi, Jaewon Jang, Junghoon Shin, Minseo Kim
Cryptography and Security
Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family
Hanrui Wang, Ruihao Zheng, Shuo Wang et al. (+3 more)
Adversarial robustness optimization aims to preserve correct prediction under
adversarial perturbations, and has produced substantial robustness gains through methods such as
adversarial training and
adversarial purification. However, we identify a new security risk: these gains can create shared vulnerabilities across defenses. Once one representative robustness-optimized defense is effectively breached, the broader family may become exposed. Studying this risk requires separating genuine transferability from distortion-induced degradation and from the algorithmic gains of sophisticated attacks. We therefore introduce stricter transfer-only protocols and a deliberately simple adaptive attack, PGDTransfer, to test whether robustness-optimized defenses share transfer-only vulnerability under controlled conditions. We further introduce
Adversarial Sensitivity Maps (AdvSMs) to visualize and quantify shared
alignment beyond differentiable classifiers, including
stochastic and non-differentiable defenses. Across adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders, we identify natural transferability within each robustness family, i.e., transfer that arises even with simple PGD-style optimization rather than specialized transferable-attack design. The risk is already severe for purification: PGDTransfer reaches an average transfer attack success rate of $80.4\%$ across filtering-, compression-, and
diffusion-based purifiers under $\epsilon=4/255$, suggesting that purifier defenses may no longer provide reliable protection. As attacks improve, currently stronger robustness families may face the same risk. Future defenses should therefore treat vulnerability diversity and transfer-only isolation as security objectives, rather than optimizing only individual robustness.
Read the full abstract ▾
All authors Hanrui Wang, Ruihao Zheng, Shuo Wang, Isao Echizen, Xingbo Dong, Zhe Jin
Cryptography and Security · Cross-listed from quant-ph
Hardware Robustness of Sample-Based Quantum Diagonalization
Ahatesham Bhuiyan, Cheng Chu, Qian Lou et al. (+1 more)
Sample-based
Quantum Diagonalization (SQD) is a hybrid
quantum-classical method that replaces variational optimization with a self-consistent recovery loop over QPU samples. Although SQD is considered robust to noisy samples and imperfect classical inputs, its robustness across practical deployment choices has not been systematically analyzed. As a result, shot budgets,
qubit layouts, noise mitigation strategies, and the coupled-cluster singles and doubles (CCSD) amplitudes that initialize the ansatz are often chosen without clear empirical guidance. We analyze SQD robustness on IBM Heron hardware across these dimensions. Structured CCSD-amplitude perturbations, including complete zeroing, produce only modest energy shifts from the clean baseline. Differences across layouts and noise-mitigation settings are large in the first recovery iteration but narrow within a few iterations. Accuracy saturates at moderate shot budgets, while very large budgets slightly worsen recovered energies, likely because working-set selection limits the value of additional samples. These results identify where SQD provides genuine deployment robustness and where its limits remain.
Read the full abstract ▾
All authors Ahatesham Bhuiyan, Cheng Chu, Qian Lou, Mengxin Zheng
Cryptography and Security
RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning
Kwunhang Wong, Jichang Yang, Karl M.H. Lai et al. (+7 more)
Edge Artificial Intelligence of Things (AIoT) systems often collect sensitive data in situ, raising serious
privacy concerns. Resistive-switching random-access
memory (RRAM) is an attractive substrate for efficient AIoT thanks to its multi-bit storage and compute-in-
memory (CiM) capabilities, while its inherently
stochastic write behavior provides a natural source of randomness that can be leveraged for differential
privacy (DP) protection. Yet how to transform this device-level randomness-typically viewed as detrimental to accuracy-into a principled randomized mechanism while preserving model utility remains underexplored. We propose RRAM-DP, a hardware-
algorithm co-design that relaxes RRAM write-verify operations to inject calibrated noise for inherently (epsilon, delta)-DP with formal DP analysis; together with pretraining techniques, it renders a novel private, high-utility CiM training paradigm. On CIFAR-10/100, STS-B, and SST-2, RRAM-DP-SGD incurs at best only a 3.8% accuracy drop at (epsilon=2, delta=O(1/n))-DP relative to non-private SGD. At the same
privacy level, RRAM-DP-SGD delivers up to 57x and 3.2x energy savings and 2.7x and 1.8x speedups over A100 and DiVa-GEMM, respectively. These results point toward efficient,
privacy-preserving in-
memory training on RRAM at the edge.
Read the full abstract ▾
All authors Kwunhang Wong, Jichang Yang, Karl M.H. Lai, Hegan Chen, Songqi Wang, Wei Xuan, Ning Lin, Han Wang, Xiaojuan Qi, Zhongrui Wang
Cryptography and Security · Cross-listed from quant-ph
CutBackdoor: A Circuit Cut Triggered Backdoor Attack on Variational Quantum Algorithms
Ahatesham Bhuiyan, Hoang Ngo, Cheng Chu et al. (+4 more)
Variational
Quantum Algorithms (VQAs) are a leading paradigm for near-term
quantum computing, combining parameterized
quantum circuits with classical optimization across
quantum chemistry, combinatorial optimization, and
quantum machine learning. Since real-world VQA deployments routinely require
circuits that exceed available hardware capacity,
quantum circuit cutting has become an indispensable execution strategy, and pre-trained parameters are increasingly distributed through public repositories, introducing supply-chain security risks that have received little
attention. Prior
quantum backdoor attacks either introduce detectable
circuit modifications or depend on device-specific noise, and none consider
circuit cutting as an attack surface. We present CutBackdoor, the first parameter-supply-chain backdoor that uses cut
circuit execution from CutQC as the deployment-time trigger against VQAs. Under noisy finite-shot
circuit-cut execution, poisoned parameters preserve full-
circuit validation performance while substantially increasing cut-path reconstruction error, without any
circuit modification. The trigger activates when a resource-limited victim responds to a
qubit-capacity mismatch by invoking the cutting workflow, requiring no attacker presence at deployment. We provide a theoretical analysis and empirically validate it across varying shot budgets. Evaluation across multiple VQA
benchmarks on IBM
quantum backends demonstrates cut-path energy amplification of $1.3\times$ to $2.9\times$ \revA{over clean baselines on the VQE and VQD
benchmarks while maintaining small stealthiness error on the full-
circuit path. The cut-path gap persists across the evaluated backends and cut placements under matched compilation; Zero-Noise Extrapolation provides only partial mitigation, and the diagonal-cost QAOA
benchmark delineates the attack's structural boundary
Read the full abstract ▾
All authors Ahatesham Bhuiyan, Hoang Ngo, Cheng Chu, Qian Lou, Lei Jiang, My T. Thai, Mengxin Zheng
Cryptography and Security
GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation
Daekwon Pi, Sangho Lee, Young Hun Lee et al. (+1 more)
While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a
dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-
ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.
Read the full abstract ▾
All authors Daekwon Pi, Sangho Lee, Young Hun Lee, Huy Kang Kim
Cryptography and Security
Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security
Devina Jain, David Hartmann and Chuan Li
LLM-based
agents process external content, exposing them to
prompt injection and multi-turn manipulation. We present a 21-scenario
benchmark for adaptive cross-session attacks against fresh-session LLM defenders: an autonomous LLM attacker observes prior defender responses and pivots across rounds, while each defender response is evaluated as a fresh interaction. A controlled 3 x 3 attacker-defender
matrix contains 945 battles. Restricting scoring to the first round yields 0-1% attack success rate (ASR); allowing 15 rounds yields 7.9-16.8%. Pooling three attacker LLMs uncovers 1.7-2.2 times as many unique successful inputs as the best single attacker, at three times the battle budget. Aggregate rates conceal opposing scenario-specific weaknesses in session-secret protection and authority handling, preserved in two higher-sample evaluations. On six scenarios, adding one provenance paragraph reduces ASR from 110/270 to 70/270, with selective effects across tasks. History and defender-state controls, together with frozen replay, characterize how the interaction protocol changes the result. A competition adds 18,422 held-out battles on a fixed gpt-oss-20b backbone and complementary benign-task evaluations. The
benchmark exposes attacker and defender models, harnesses, scenarios, session state, and interaction budgets as configurable choices for systematic security evaluation.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.IT
Optimal Domain-Aware Privacy Mechanisms for Synthetic Data Generation
Sajani Vithana, Sangwon Jung, Haoyang Hu et al. (+3 more)
Differential
privacy (DP) imposes fundamental trade-offs between
privacy and statistical fidelity in synthetic data generation. While access to public data has been shown to improve these trade-offs empirically, existing approaches use public data only indirectly, through pre-processing (e.g., using pre-trained generative models) or post-processing steps (e.g., matching target statistics estimated from public
datasets), while relying on domain-agnostic DP mechanisms. In this work, we lay the theoretical framework to study the principled incorporation of public data into DP mechanisms themselves. We consider normalized histograms as distribution
estimators and characterize the asymptotically optimal domain-aware
privacy mechanism within a specific class of DP mechanisms. We introduce PubMix, a public-data-aware DP mechanism that can be used in histogram-based data synthesis pipelines. Our experiments demonstrate that PubMix significantly improves synthetic data generation quality compared to domain-agnostic
privacy mechanisms.
Read the full abstract ▾
All authors Sajani Vithana, Sangwon Jung, Haoyang Hu, Viveck R. Cadambe, Flavio P. Calmon, Haewon Jeong
Cryptography and Security
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
Yimeng Chen, Nathanaël Denis, Roberto Di Pietro et al. (+1 more)
Self-hosted AI
agents maintain persistent
memory, instructions, and configuration that influence their future behavior. If an
agent is compromised, an attacker can exploit the
agent's legitimate write permissions to corrupt this self-state, making malicious and benign updates difficult to distinguish at the operating system (OS) level. We investigate how far existing OS mechanisms can prevent, detect, and recover from such self-state attacks. We formalize an attack space and evaluate representative OS defenses using four
agent workloads and a Linux telemetry pipeline. Our results show a consistent limitation across defense dimensions. File-level controls either leave alternative mutation paths open or, when complete over the tested operations, also block corresponding legitimate updates. Detectors flag a substantial part of legitimate activity, while more selective methods cover only part of the attack space. Finally, protected backups successfully restore corrupted state, but require a trusted recovery point and may incur rollback cost. Overall, our results show that the main limitation is not OS observability. Indeed, the OS can enforce, observe, attribute, and recover self-state changes. Yet, generic OS defenses lack the decision context needed to combine broad operation coverage with selective decisions. Effective protection therefore requires self-state-aware mechanisms that exploit additional context beyond generic file and syscall behavior.
Read the full abstract ▾
All authors Yimeng Chen, Nathanaël Denis, Roberto Di Pietro, Jürgen Schmidhuber
Cryptography and Security
RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control
Di Lu, Bo Zhang, Xiyuan Li et al. (+5 more)
Natural-
language control offers a promising interface for unmanned aerial vehicles (
UAVs), but directly applying self-hosted computer-use
agents (SHCUAs) to
UAV control introduces a structural mismatch. SHCUAs are designed for interactive host-side tool use, where delayed
agent iterations are often acceptable.
UAV control, however, is coupled with continuously changing physical states, strict timing constraints, safety risks, and security accountability. A stale, unauthorized, or tampered
agent decision may therefore lead to unsafe or untraceable vehicle behavior. This paper proposes a real-time and security-oriented restructuring of SHCUA-based
UAV control. Instead of allowing an SHCUA to directly issue flight commands, we transform its outputs into contract-bound
UAV skill invocations with explicit timing, state, authority, fallback, and evidence semantics. Based on this abstraction, we design an architecture that separates semantic
reasoning from onboard execution and security/safety enforcement. Slow cloud or edge
reasoning is used for mission understanding, while onboard components validate and dispatch only timely, authorized, and state-consistent skills. Security-critical enforcement points can be protected by TEE-style or microcontroller isolation mechanisms without moving the full
language agent or high-frequency flight-control loop into trusted components. Prototype evaluation shows that RT-SHCUA maintains bounded task-level responsiveness while supporting degraded handling, trusted admission, and auditable evidence preservation for SHCUA-mediated
UAV actions.
Read the full abstract ▾
All authors Di Lu, Bo Zhang, Xiyuan Li, Yongzhi Liao, Xuewen Dong, Yulong Shen, Zhiquan Liu, Jianfeng Ma
Cryptography and Security
Rate-Distortion Function for Encrypted Traffic Side-Channel Defense
Guangjie Liu, Guang Cheng, Weiwei Liu et al. (+1 more)
Parameter selection for encrypted traffic defense has long relied on empirical tuning, yet the fundamental question – \emph{given a QoS cost budget $D$, how low can the leakage rate go under sustained observation?} – lacks a provable, computable baseline. Taking the semantic label sequence $X^n$ as the source, the defended feature sequence $Y^n$ as the observation, and Wasserstein-1 distance as the defense cost, we define the side-channel rate-distortion function $R^{\mathrm{sc}}(D)$ within the stationary memoryless defense class $\Theta_{\mathrm{iid}}$ and provide its complete characterization. We prove that $R^{\mathrm{sc}}(D)$ is monotone decreasing, convex, and continuous, with exact endpoints; the optimal defense has an exponential-tilting (Boltzmann) structure governed by KKT conditions; and the curve constitutes the exact Pareto frontier within $\Theta_{\mathrm{iid}}$. For binary equal-prior tasks, $D_{\max} = \tfrac{1}{2}W_1(P_0,P_1)$ via Kantorovich–Rubinstein duality. On real-world website-fingerprinting defenses, the framework locates Front ($\Delta_{\mathrm{gap}}{=}0.028$\,bits), WTF-PAD ($0.034$\,bits), and TrafficSliver ($0.124$\,bits) above the theoretical curve, quantifying their suboptimality gaps.
Read the full abstract ▾
All authors Guangjie Liu, Guang Cheng, Weiwei Liu, Yutong Wang
Cryptography and Security
Residual Observability and Attack Detectability in Encrypted OPC UA Traffic
Song Son Ha, Florian Foerster, Henry Beuster et al. (+3 more)
OPC Unified Architecture (OPC UA) encryption conceals application-layer semantics and restricts intrusion detection to residual communication structure. Although machine learning-based intrusion detection systems (IDSs) can detect attacks in encrypted OPC UA traffic, the relationship between residual structural observability and attack detectability remains insufficiently understood. This paper presents an explanatory framework combining a structural observability profile, the Structural Leakage Score (SLS), controlled within-family and cross-family comparisons, phase-specific analysis, and dimension-ablation analysis. Jensen–Shannon divergence is used to characterize transport, temporal, and protocol-lifecycle dimensions, while the SLS summarizes the residual structural magnitude. Evaluation on an industrial private 5G testbed covers four attack families with progressively reduced nominal activity. SLS generally tracks within-family recall trends but does not reproduce cross-family detectability ordering. Interpreting these mismatches also requires temporal prevalence, inter-burst persistence, predictive utility, unique contribution, and redundancy. The framework complements conventional IDS metrics by relating detection outcomes to the magnitude, temporal distribution, and predictive role of observable structural evidence.
Read the full abstract ▾
All authors Song Son Ha, Florian Foerster, Henry Beuster, Eduard Zeller, Dominik Merli, Gerd Scholl
Cryptography and Security · Cross-listed from cs.RO
Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
Tuan Duong Trinh, Naveed Akhtar and Basim Azam
Does adding a
reasoning step make a
Vision-
Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the
reasoning spectrum (no
reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the
vision,
reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the
reasoning design shift robustness, and can the
reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both
stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the
reasoning depth at inference barely moves it.
Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan–action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box
vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.
Read the full abstract ▾
Cryptography and Security
Insecure Coding Preferences in Long-Term Memory: Security Risks for LLM-based Code Generation
Yuchen Chen, Wei Cheng, Yuan Xiao et al. (+7 more)
LLM-based systems increasingly incorporate long-term
memory to improve cross-session continuity. However, once insecure coding preferences are stored, they may silently influence security-critical decisions in subsequent generations. In this study, we conduct the first systematic empirical study on the impact of insecure coding preferences stored in long-term
memory on the security of LLM-based code generation. We evaluate four LLMs (ChatGPT, Gemini, Qwen, and Grok) across five programming
languages (Python, C, C++, Go, and JavaScript). Our results show that insecure
memories significantly increase the risk of generating vulnerable code by 2.7-50.3 percentage points (pp). Moreover, they create a 5.4-14.0 percentage-point risk-warning gap, where warning-rate increases lag behind vulnerability-rate increases. Further analysis reveals that insecure
memories are difficult to overwrite through normal interactions and can broadly influence model outputs even when
prompts are phrased differently. Finally, we evaluate three mitigation strategies: security-requirement appending and
memory storage reduce vulnerability rates by 19.7-33.6 pp but may degrade functional correctness by up to 15.9 pp;
memory-level safety filtering achieves a 100% detection rate on our evaluated risky
memory entries and restores generation behavior to the without-
memory baseline. Based on these findings, we provide actionable suggestions to improve the security of long-term
memory in LLM-based code generation.
Read the full abstract ▾
All authors Yuchen Chen, Wei Cheng, Yuan Xiao, Zhou Yang, Weifeng Sun, Chunrong Fang, Xiang Chen, Baowen Xu, David Lo, Zhenyu Chen
Cryptography and Security
Protecting Floating-Point Computation for DNN Binaries with MBA Obfuscation
Yikun Hu, Zichen Zhao, Peixiang Qin et al. (+4 more)
This submission was made prematurely and has been withdrawn by the authors for substantial revision before further dissemination.
Read the full abstract ▾
All authors Yikun Hu, Zichen Zhao, Peixiang Qin, Ziyi Zhou, Jiaping Gui, Yuandao Cai, Wensheng Tang