Cryptography and Security
SP2UBI: Secure and Privacy-Preserving Usage-Based Insurance
Mobin Aghamirkarimi, Matin Aghamirkarimi, Farid Zaredar et al. (+1 more)
The transition from traditional auto insurance, whose basis is defined by a set of static parameters, like the age of driver and number of accidents, to Usage-Based Insurance, whose pricing is based on driving behavior, was boosted by Intelligent Transportation Systems. At the same time, the analysis of high-resolution telematics data might reveal users' behavior and habits, which is associated with significant
privacy concerns. The majority of
privacy-preserving UBI systems are subject to policyholders' data leaks at some point during the life cycle of their protocol. Moreover, it is challenging to ensure data integrity against possible intentional or unintentional sensor anomalies (like sensor spoofing or malfunctioning) since the approaches used in this case require
privacy-compromising audits and do not consider the oracle problem. In order to address the issues, we propose SP2UBI, a
privacy-preserving UBI solution which guarantees mutual confidentiality. SP2UBI collects the telematics data in coarse-grained, statistical form without any spatiotemporal identifiers so that it is impossible to reconstruct fine-grained mobility traces. By utilizing the
Torus Fully Homomorphic Encryption scheme, which incurs low computational overhead, computations are performed directly over encrypted data. This way, the insurer calculates risk factors without accessing any sensitive information, while parameters of its risk model are confidential. In order to protect data integrity against sensor level manipulation, SP2UBI incorporates a speed verification system assisted by Integrated Sensing and Communications (
ISAC) technology which is capable of detecting fraud while preserving user
privacy. Experimental evaluation shows that one round of protocol execution takes 41.2 ms, showing that our framework is lightweight and preserves more
privacy guarantees compared to state-of-the-art solutions.
Read the full abstract ▾
All authors Mobin Aghamirkarimi, Matin Aghamirkarimi, Farid Zaredar, Morteza Amini
Cryptography and Security
How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection
Lorenzo Guerra, Thomas Chapuis, Guillaume Duc et al. (+2 more)
Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols. We investigate this dependency by re-evaluating representative PIDS on public
datasets that meet our audit, labeling, and calibration requirements. Focusing primarily on the audited DARPA TC E3
datasets, we apply a unified protocol with temporally separated test periods and validation-only checkpoint selection and threshold calibration, and ask which architectural claims are empirically supported. We find that alerting success and investigation utility can diverge sharply, as several systems surface attacks without providing enough process-level context to support forensic investigation. Across the four primary
datasets, a simple allowlist built from executable names and paths observed during training matches or exceeds the selected learned baselines on key operating-point metrics, showing that comparable performance on these metrics is achievable using lexical novelty alone. Quantifying semantic signal quality through feature completeness and field
entropy helps explain why several audited E3
datasets support alerting performance without reliably separating model architectures. Theia, however, provides the richest semantic signal and is the only primary
dataset on which our reference model, Theseus, clearly improves both ranking and node-level recovery over the other learned systems. Overall, these findings reinforce the importance of interpreting architectural claims in PIDS together with the
benchmark properties and evaluation protocol that produced them.
Read the full abstract ▾
All authors Lorenzo Guerra, Thomas Chapuis, Guillaume Duc, Pavlo Mozharovskyi, Van-Tam Nguyen
Cryptography and Security · Cross-listed from cs.AI
No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks
Simiao Xie, Chuancheng Shi, Shangze Li et al. (+5 more)
With the rapid release of open-weight large foundation models, safety threats are shifting from black-box jailbreaks to
neuron-level white-box attacks that directly identify and manipulate safety-related
neurons. Existing
alignment methods often investigate the safety behavior on a small number of
neurons, creating fragile single point of failure with limited redundancy. To address this issue, we propose distributed safety
alignment (DSA), which redundantly encodes safety capabilities across multiple computational
neurons, ensuring that the model maintains its safety baseline even when critical safety
neurons are disrupted. Specifically, we localize the intervention to the inputs of the down-projection layers in
language-side feed-forward networks and treat each feature coordinate as the activation of an individual
neuron. DSA then combines
neuron activations with loss gradients to compute a direction-aware first-order Taylor score that globally identifies the
neurons that contribute most to the current refusal behavior of the model. Finally, targeted disruption via deterministic masking and
stochastic dropout is coupled, forcing the model to abandon narrow safety
neurons and redundantly encode safety behavior across multiple compensatory
neurons. Extensive experiments show that DSA substantially improves robustness against white-box
neuron-level safety attacks while preserving the model's general
language and
multimodal utility.
Read the full abstract ▾
All authors Simiao Xie, Chuancheng Shi, Shangze Li, Wenhua Wu, Fei Shen, Ying Zhou, Zhiyong Wang, Tat-Seng Chua
Cryptography and Security
Pivot: Proactive and Verifiable Threshold Oblivious Pseudorandom Functions From Isogeny Group Actions
Abhinav Sharma and Vikas Srivastava
Oblivious pseudorandom functions (OPRFs) allow a client to evaluate a keyed pseudorandom function on a private input without revealing that input to the server. In a threshold OPRF, the secret key is distributed among (n) servers so that any qualified set of at least (t) servers can complete an evaluation, while fewer than (t) shares reveal no information about the key. Existing isogeny-based threshold OPRFs, however, are primarily designed for static corruption models. If the same shares remain valid throughout the lifetime of the service, a mobile adversary can compromise different servers over time, accumulate (t) shares from the same sharing state, and eventually recover the master key. We introduce PIVOT (Proactive Isogeny-based Verifiable Oblivious Threshold PRF), a dealerless threshold VOPRF framework based on effective isogeny group actions. PIVOT periodically refreshes the server shares without changing the master key, public key, or previously generated OPRF outputs. The construction combines Shamir secret sharing, additively homomorphic coefficient commitments, sequential Lagrange-weighted group actions, and joint zero-knowledge relations that link certified shares to their corresponding isogeny actions. It also supports coordinated epoch transitions, publicly verifiable blame, secure erasure, and committee resharing under a possibly different threshold. We formalize the functionality of a long-lived proactive threshold VOPRF, prove the correctness of distributed key generation, threshold evaluation, proactive refresh, and committee resharing, and provide a simulation-based security analysis under the vectorization and one-more hidden-group- action assumptions. As an application, we describe a distributed private lookup service whose encrypted database remains valid across repeated share renewals and committee migrations.
Read the full abstract ▾
Cryptography and Security
Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety
Ruiyang Zhang
Runtime safety monitors based on Linear Temporal Logic (LTL) and finite automata (FSA) are increasingly deployed to intercept unsafe tool-call sequences in LLM
agents. Yet the same monitor achieves 68-75% attack coverage on some model architectures and near-zero on others, with no explanation from capability scores, training data, or
prompt design. We provide the missing theory. We prove that the recall of any fixed-invariant FSA monitor is bounded above by the concentration of the attack distribution: the fraction of attacks covered by the k most frequent trigger-completion patterns. When attacks concentrate (low Shannon
entropy), a small fixed invariant set achieves high recall; when they disperse across many structurally distinct patterns (high
entropy), no fixed invariant set of tractable size can, regardless of how the invariants were derived. We validate this
entropy-coverage bound across eight frontier LLM architectures. GPT-class and DeepSeek backends yield highly concentrated attacks (H ~ 0.24 bits; one pattern covers 96%), explaining 68-75% recall; Gemini variants yield high-
entropy distributions (H ~ 2.81 bits; 7 clusters each <= 7%), explaining near-zero recall (6-13%), invariant to architecture-matched retraining.
Entropy accounts for 76% of variance in coverage (Pearson r = -0.87, p = 0.005, 95% CI [-0.98, -0.78]), holding under leave-one-out (r in [-0.91, -0.82]). We introduce a pre-deployment
entropy test that predicts monitor coverage from a small attack sample, enabling architecture-aware monitor selection before deployment. The bound and test are architecture-agnostic and apply to any FSA-based runtime monitor over discrete action sequences.
Read the full abstract ▾
Cryptography and Security
AdaptoNet: Modular Foundation-Adaptive Neural Networks for Cyber-Physical Attack Detection in Power Grids
Anissa Elias, Jennifer Rogers, Hui Lin et al. (+1 more)
Cyber attacks on the power grid combine physical disruptions with compromised data to destabilize cyber-physical systems. We demonstrate that data denial attacks, where adversaries block measurements in a targeted region while triggering a line outage, reduce detection performance by more than 86%, rendering standard data-driven methods ineffective. We propose AdaptoNet, a modular neural network that adapts to measurement availability through conditional controls. AdaptoNet pairs a frozen foundational module trained on complete data with a trainable adaptive module, conditioned on a binary measurement-availability vector, enabling the model to distinguish between denied and anomalous data without retraining the foundational module. Evaluated across four IEEE test systems (30-, 39-, 57-, and 118-bus) under in-region attacks blocking up to 20% of measurements, AdaptoNet recovers F1 from below 12% to above 81%, an approximate sevenfold improvement approaching the 89%-99% baseline with complete measurements.
Read the full abstract ▾
All authors Anissa Elias, Jennifer Rogers, Hui Lin, Yan Sun
Cryptography and Security
The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails
Shuo Shi, Rui Yin, Naen Xu et al. (+7 more)
Multimodal guard models have emerged as critical safety components for screening content in
vision-
language systems. While
adversarial research has extensively studied jailbreaking attacks that produce false negatives, the inverse threat of inducing false positives on benign inputs remains unexplored. We introduce Unsafe Induction Attacks, where adversaries distribute imperceptibly perturbed safe images that trigger guard models to reject legitimate user requests, causing a "Boy Who Cried Wolf" effect that degrades service availability and erodes trust. This reveals an availability failure mode in deployed safety filters. To realize this threat under diverse user
prompts, we propose Unsafe Semantic
Distillation (USD), which aligns
adversarial perturbations with distributional representations of unsafe content rather than
prompt-specific instances. Evaluated on four state-of-the-art guard models across realistic user simulation scenarios, USD achieves 84% attack success rates, outperforming existing methods and exposing fundamental vulnerabilities in current
multimodal safety architectures.
Read the full abstract ▾
All authors Shuo Shi, Rui Yin, Naen Xu, Jiahao Chen, Chunyi Zhou, Tianyu Du, Zhihui Fu, Jun Wang, Zhaoxiang Wang, Shouling Ji
Cryptography and Security · Cross-listed from cs.AI
Reputation-driven Cooperation in Lattice-based Decentralized Federated Learning through Evolutionary Game Theory
Phuc Hoang Truong Huynh, Dung Tran Vinh, Khoa Duc Anh Lam et al. (+9 more)
Decentralized
Federated Learning (DFL) has emerged as an optimal
privacy-preserving solution; however, it remains vulnerable to opportunistic behaviors due to the absence of a central coordinator. While Evolutionary Game Theory (EGT) serves as a powerful framework for analyzing such behaviors, existing studies often assume that
agents possess perfect rationality and maintain static strategies. To address these limitations, this paper proposes a novel EGT framework designed to analyze strategic
evolution and enhance overall system performance. The primary contributions of this work are threefold: First, we model peer-to-peer (P2P) interactions on a
lattice network structure under the assumption of bounded rationality. Second, we formulate a comprehensive payoff
matrix incorporating training costs, communication overhead, and cooperative rewards, while tailoring a strategy update rule that captures spatial propagation dynamics. Third, we integrate a reputation-based reward-and-punishment mechanism to effectively deter free-riding behaviors. Simulation results demonstrate that the framework significantly outperforms the baseline. Specifically, it increases average accuracy from approximately 70% to 82%, elevates cooperation frequency to approach 100% (compared to below 5% in the baseline), and drops accuracy variance from around 0.40 to 0.002, thereby accelerating uniform convergence and ensuring system stability.
Read the full abstract ▾
All authors Phuc Hoang Truong Huynh, Dung Tran Vinh, Khoa Duc Anh Lam, An Nghiem Nguyen Truong, Uyen Nha Tran Bui, Khang Nguyen Dinh, Bao Nguyen Le Gia, Minh Le Nguyen Nhat, Manh Hong Duong, The Anh Han, Thi Ai Thao Nguyen, and Le Hong Trang
Cryptography and Security
A Unified Benchmark for Privacy-preserving Vector Search
Anne-Marie Kermarrec, Rafael Pires, Mathis Randl et al. (+1 more)
Vector search powers semantic search, recommendation systems, and
retrieval-augmented generation (RAG). By design, the service answering a query sees both the query
embedding and, usually, the corpus against which it is matched. This is a
privacy breach for both the user issuing the query and the owner of the corpus. A family of cryptographic schemes (e.g., SAP, EMVP, BNTM, Tip-toe) addresses that leak. However, as each scheme is published and evaluated on its own corpus, threat model, parameter choices, hardware, and metric conventions, the numbers cannot be compared directly. Consequently, a practitioner asking which one to deploy today has no defensible way to choose. We close that gap with a uniform experimental comparison, including a Plaintext baseline and four cryptographic backends running over the same workload, hardware, and metric definitions. Under that ruler, the schemes spread across a Pareto frontier in
privacy, performance, and recall rather than imposing a flat penalty on performance. We find that the performance of SAP matches Plaintext, EMVP delivers cryptographic indistinguishability at a 4x throughput cost on CPU, BNTM adds malicious-server verifiability at a further 22x median-latency cost, and Tiptoe hides the cluster choice itself, but incurs a 190x per-query cost compared to Plaintext. GPU acceleration pays off for Plaintext and SAP but not for EMVP or BNTM. All our experiment artifacts are publicly available for reproducibility
Read the full abstract ▾
All authors Anne-Marie Kermarrec, Rafael Pires, Mathis Randl, Martijn de Vos
Cryptography and Security
Latency-Optimal Adaptive Split Inference for Privacy-Preserving Cloud-Edge-End Collaboration
Yi Li, Peng Zhang and Man Ho Au
Internet of Things (IoT) end devices are increasingly expected to support
privacy-sensitive batch inference, yet their limited computational resources often make full local execution of convolutional neural networks impractical. This paper presents a latency-optimal adaptive split inference framework for
privacy-preserving cloud-edge-end collaboration. The end device acts as the trust anchor, executes the plaintext model prefix, encrypts the split activation using fully homomorphic encryption (FHE), and keeps the secret key locally, while the edge and cloud execute assigned model segments only on FHE ciphertexts. We formulate collaborative encrypted inference as a split-pair selection problem over an end-side split point and an edge-side termination point. The proposed planner jointly models plaintext prefix execution, encryption, communication, edge-side FHE execution, and cloud-side FHE completion, and supports both convolution-level and block-level split granularities. Experiments on CIFAR-10 and PathMNIST show that the proposed convolution-level collaborative scheme achieves amortized end-to-end speedups of approximately 12.9 times over full-cloud FHE and 3.9 times over the block-level alternative, while preserving the corresponding plaintext-model accuracy. Including modeled communication, the amortized latencies are 1033.279 s/sample on CIFAR-10 and 1023.429 s/sample on PathMNIST.
Read the full abstract ▾
Cryptography and Security
SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks
Siyuan Li, Aodu Wulianghai, Zehao Liu et al. (+8 more)
Large
Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of
prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent-oriented taxonomy that organizes multi-turn jailbreaks by
adversarial intent structure. Through controlled ablations, we find that effectiveness is driven by how deliberately intent is organized across turns rather than by context length or query count. We further show that the way intent is organized determines the level at which it becomes detectable, pushing the required detection surface outward from the turn level to the session level to the cross-session level. These findings indicate that turn-local safety mechanisms are structurally insufficient and that single-point evaluation overlooks how intent is organized, motivating evaluation protocols aligned to the level at which harmful intent becomes observable. The code is available at: https://github.com/SiyuanLi00/INTACT.
Read the full abstract ▾
All authors Siyuan Li, Aodu Wulianghai, Zehao Liu, Xi Lin, Qinghua Mao, Haoyu Li, Xiang Chen, Siyuan Liang, Jun Wu, Jianhua Li, Dacheng Tao
Cryptography and Security
Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks
Haoyu Zhang, Xiangchen Guan, Shibo Zheng et al. (+2 more)
We report a counter-intuitive interaction between image inputs and existing black-box defenses on
Vision–
Language Models (VLMs): pairing an encoded jailbreak
prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant under exact McNemar tests. We advance two hypotheses for this pattern, supported by indirect evidence rather than pipeline introspection, since a black-box threat model precludes inspecting vendor internals: caption-mediated defenses branch on image presence, and intrinsic image-side safety engages on image-resident content. Three controls constrain the explanation. Blank-canvas and natural-photograph decoys reproduce the effect on every model, implicating image presence rather than content; the effect replicates on three open-weight VLMs served with no moderation layer, so it is not a vendor-filtering artifact; and a non-symbolic, meaning-based encoder reproduces it, so it is not specific to symbolic obfuscation. Attaching a decoy unconditionally is not deployable — it raises benign refusal to $20$–$79\%$, an inflation of $+10$ to $+67$pp — but gating attachment on a lightweight encoded-input detector returns benign refusal to the text baseline while preserving the safety gain wherever the detector fires, making detector recall the binding constraint. Under adaptive attacks that target the caption-mediated re-check, the effect degrades but holds. We frame this as an observation about pipeline interaction, not as a robust defense.
Read the full abstract ▾
All authors Haoyu Zhang, Xiangchen Guan, Shibo Zheng, Mohammad Zandsalimy, Shanu Sushmita
Cryptography and Security
CallScreenBench: Benchmarking Small Language Models as Phone Secretaries
Jiaqi Gan, Haoyuan Tang, Jamey Z. Liang et al. (+6 more)
Language models small enough to run on a handset, quantized to a few bits, are increasingly capable of acting on their user's behalf – which makes on-device task automation newly plausible. One such task is answering the phone. A phone secretary takes an unknown inbound call on its owner's behalf, and unlike the
agents most
benchmarks evaluate, it has no cooperative caller-assigned task to complete: the caller holds the goal and may be an adversary, while the secretary must begin deciding how to respond without an oracle. What matters is not task success but whether the owner would endorse how their proxy handled the call. We evaluate only the text-domain conversational decision layer;
speech recognition, audio interaction, end-to-end latency, and handset execution are outside scope. We present CallScreenBench, which reports five automated call-and-note measure groups motivated by owner endorsement. Each is paired, where available, with a counter-metric and an uncertainty estimate; no
benchmark-wide Q1-Q5 composite or leaderboard score is defined. Three guardedness diagnostics identify candidate cases for a toolless proxy that holds no credentials and calls no tools. Across three model families represented by paired 4-bit checkpoints (0.6-4B), the primary scoring snapshot gives the larger checkpoint higher point estimates on several service, recall, and plausibility measures, while triage discrimination follows a different ordering. Bare scam-side TPR rewards universal suspicion, and pairwise separation changes when legitimate-side false positives are included and across judge snapshots. Scripted degenerate
agents expose further floors, including a hangup-and-echo policy with entity recall 1.000. We report quality measures and guardedness channels separately so that a single pass/fail score does not hide their trade-offs.
Read the full abstract ▾
All authors Jiaqi Gan, Haoyuan Tang, Jamey Z. Liang, Siying Chen, Ankit Raj, Kidus Zewde, Yuchen Zhou, Yuxin Zhang, Simiao Ren
Cryptography and Security
Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference
Shuaifan Jin, Zhibo Wang, Qiyuan Wang et al. (+5 more)
Collaborative inference deploys Large
Vision-
Language Models (LVLMs) by partitioning computation between edge devices and the cloud. While withholding raw inputs supposedly ensures
privacy, transmitting intermediate hidden states exposes a critical attack surface. However, it remains unclear whether deep-layer LVLM hidden states retain recoverable private information, given that visual content has been projected into the
language embedding space. To address this concern, we theoretically analyze LVLM hidden-state recoverability and show that, under regularity assumptions and a positive semantic–nuisance margin,
privacy-relevant visual semantics remain identifiable and stably recoverable. Motivated by this analysis, we propose RASR, a novel coarse-to-fine
multimodal reconstruction attack. RASR obtains initial image and text reconstructions through modality-specific inverse paths that follow their respective forward processing pipelines in reverse, and then uses hidden-state consistency to refine both reconstructions. Evaluations on Qwen3-VL-8B-Instruct and LLaVA-1.5-7B across five
datasets demonstrate that RASR reduces image reconstruction MSE by \(\sim\)50% compared to the strongest baselines, while achieving up to 99%
token accuracy for text recovery. These results show that
privacy-sensitive visual and textual information can be recovered even from deep-layer LVLM hidden states, exposing the
privacy risks of collaborative inference.
Read the full abstract ▾
All authors Shuaifan Jin, Zhibo Wang, Qiyuan Wang, Yiting Han, Yajie Zhou, Yuanfan Zhang, Jiahui Hu, Xiaoyi Pang
Cryptography and Security · Cross-listed from cs.AI
From AI Technical Debt to Agentic Technical Debt: A Systematic Mapping of Root Causes and Manifestations in Agentic AI Systems
Muhammad Tukur, Hayatullahi B. Adeyemo, Tao Chen et al. (+5 more)
The emergence of Agentic AI systems, characterized by autonomous
reasoning, multi-
agent collaboration, tool orchestration, adaptive decision-making, and persistent
memory, represents a fundamental shift from traditional AI pipelines to dynamic software ecosystems. While AI Technical Debt (AITD) has been widely studied in machine learning and software engineering, existing models assume static, component-level architectures and fail to capture the dynamic and emergent behaviors of agentic environments. To address this gap, this paper introduces Agentic Technical Debt (AgTD), defined as technical debt that emerges, accumulates, propagates, and amplifies due to the autonomous and collaborative nature of Agentic AI systems. Building on our prior systematic scoping review of 31 AITDs across seven root-cause categories, we employ a theory-informed transformation methodology to reinterpret these debts in Agentic AI through direct transformation, contextual transformation, and manifestation expansion. We present the first systematic mapping of established AITDs to their agentic manifestations, showing how conventional debts evolve into system-level liabilities, including
memory inconsistencies, orchestration fragility, cascading failures, and unsafe autonomous decision-making. Our findings show that technical debt extends beyond software artifacts to encompass
agent behaviors, coordination mechanisms, and interactions among
agents, tools, and execution environments. We further examine its implications for AI Trust, Risk, and Security Management (AI TRiSM), highlighting impacts on trustworthiness, governance, security, operational resilience, and Sustainability Technical Debt. Overall, this work establishes AgTD as a foundational software engineering construct and provides a transformation framework, taxonomy, and research agenda for managing technical debt in autonomous multi-
agent AI systems.
Read the full abstract ▾
All authors Muhammad Tukur, Hayatullahi B. Adeyemo, Tao Chen, Nour Ali, Anis Zarrad, Marco Agus, Rick Kazman, Rami Bahsoon
Cryptography and Security · Cross-listed from cs.SE
Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It
Gautam Bharti
Security studies of the Model Context Protocol (MCP) ecosystem share a design: each audits a registry at a single point in time. None reports how long the registry descriptions those audits judged stay current - a necessary condition for any description-level finding to still apply, though not a sufficient one: we measure the shelf-life of the audited text, not the validity of a security finding itself (Sec. 7.1). We reconstruct 120 observations of the official MCP registry over 88.6 days, covering 19,099 distinct servers as it grew from 3,510 to 18,966. Our central result is a policy one: you cannot keep description-level findings current by re-auditing the servers that drift most. At a top-5% re-audit budget, ranking by prior drift catches only ~20% of the previously-seen servers whose description changes in a held-out window - versus ~27% for descriptor drift overall - and only ~10% of all description changers. The limit is not unpredictability: the ranking still buys ~4x lift. It is that the description surface is sparse - 8.6% of servers ever rewrite one, against 24.8% for descriptors - and that roughly half of all description changes land on new arrivals a history ranking cannot reach, so the same lift buys far less coverage. The control that fits is content-binding - revalidate the moment a description's hash moves - plus a sized periodic full-catalog sweep; a drift-history ranking is at best a partial, blind-to-new-arrivals control. This is scanner hygiene for a description-level auditor, not a runtime trust signal. Of servers observed across at least ten intervals, three-quarters never change, the most active 5% generate 61% of all change events, and only 11.9% of a cohort's descriptors change within 30 days; naive compounding predicts 35.8% at 30 days (73% at 89), a heavy-tail overestimate we use only as a diagnostic. We release the panel, figure generator, and analysis code.
Read the full abstract ▾
Cryptography and Security
An AI Approach to Verified Production Cryptographic Libraries
Chuyue Sun, Su Fong, Zhiyi Kuang et al. (+5 more)
Cryptographic code is critical infrastructure that must be correct, yet formally verifying production libraries remains difficult. Existing
language-model proof systems solve isolated obligations with specifications and premises already given, leaving production-library verification unresolved. We present CryptoProver, an AI-based system that synthesizes internal specifications and Verus-checked proofs from high-level API contracts. Without changing executable code, CryptoProver constructs a new independent proof of curve25519-dalek and verifies RustCrypto's previously unverified chacha20 implementation against an RFC 8439 specification. These cryptographic lineages underpin deployed systems including Signal and Shadowsocks; Signal has an estimated 218M global downloads. The original developers report a focused five-month, three-person effort to verify curve25519-dalek. Given the API contracts and a fixed trusted library of field specifications, arithmetic facts, axioms, and vstd, CryptoProver synthesizes the internal specifications and proofs in 11.4 hours with USD 466.99 in recorded API cost. CryptoProver follows a trust-first design principle: mechanical gates reject specification weakening, invented axioms, and cross-module breakage, while isolation blocks reference proof
retrieval, including from git history.
Read the full abstract ▾
All authors Chuyue Sun, Su Fong, Zhiyi Kuang, Yizheng Jiao, Nina Narodytska, Haoze Wu, David L. Dill, Clark Barrett
Cryptography and Security
What Syntax Cannot See: The Dynamic Syntactic Invariance Principle and Several Instances of the Same Hidden Assumption, and a Contradiction
Fabio F.G. Buono
This paper develops a single method, find what an accepted result silently assumed, make it a variable, and prove what follows once it is dropped, and shows it keeps working across domains with nothing in common. Its formal core is the Dynamic Syntactic Invariance Principle: a known static inaccessibility result survives when a system's rules evolve in time, under one sharp necessary condition. A direct cryptographic payoff follows: the secrecy of a rolling-key scheme persists across sessions under a structural update, strengthening a static guarantee from earlier work. The same move is then carried into settings far from each other, special relativity, the reach of a formal theory of physical law, and computable output that is fully meaningful yet indistinguishable from noise to every observer, each established on its own terms, so the recurring structure beneath them is found, not imposed: a distinction real at a full level of description can be invisible at a restricted one. Applied to SAT, this yields a contradiction from which coherence forces $\mathsf{P}\neq\mathsf{NP}$, derived from what standard theory already admits rather than assumed,offered with one reservation, about the proof, not the answer.
Read the full abstract ▾
Cryptography and Security
NoisePQC++: A Unified NIST-Compliant PQC and Hybrid-PQC Implementation of the Noise Protocol
Nadeem Ahmed, Aryya Gangopadhyay and Lei Zhang
The threat of
quantum computers to classical public-key cryptography has created an urgent need to evolve secure communication protocols with post-
quantum cryptographic (PQC) primitives. The Noise Protocol Framework, widely used in systems such as WireGuard and WhatsApp, traditionally relies on the Elliptic Curve Diffie-Hellman (ECDH) public-key exchange scheme, which is vulnerable to
quantum threats. In this paper, we present NoisePQC++, a unified C++23 implementation of the Noise Protocol framework augmented with post-
quantum Key Encapsulation Mechanisms and Hybrid Forward Secrecy. Our design integrates the National Institute of Standards and Technology (NIST) standardized ML-KEM
algorithm alongside classical ECDH, enabling full PQC, hybrid ECDH+PQC handshakes, and unified support for all 57 classical Noise handshake pattern variants, 13 post-
quantum Noise handshakes, and their hybrid variants. Compared with prior work, NoisePQC++ offers broader protocol coverage, more complete implementation support, and greater flexibility. Our evaluation shows minimal overhead under normal network conditions and acceptable overhead in adverse cases, while significantly improving resistance against
quantum adversaries. These results indicate that NIST-standardized post-
quantum and hybrid Noise handshakes are practical and provide a credible basis for future deployment.
Read the full abstract ▾
Cryptography and Security
Neuro-Symbolic Participation Governance for Verifiable AI Agents in Open Digital Twin Ecosystems
Juan Li, Wei Cai and Yan Bai
Autonomous AI
agents, increasingly empowered by large
language models, are becoming important components of human-machine systems for high-stakes decision support in digital twin ecosystems. However, existing multi-
agent systems often lack robust verification for identity, capability, and policy compliance, especially in decentralized environments spanning multiple institutions. This paper proposes a neuro-symbolic decentralized governance framework for verifiable
agents in collaborative digital twin environments. By representing
agents through multi-layer semantic profiles, the framework bridges probabilistic neural
reasoning with deterministic institutional governance, thereby supporting trustworthy human-AI collaboration and meaningful human oversight. Capabilities are grounded in formal domain ontologies to enable machine-interpretable, policy-aware, and context-sensitive participation. These credentials, issued by organizational authorities, are validated via blockchain-based smart contracts, ensuring auditable participation without exposing sensitive data. We demonstrate the framework using a decision-support prototype with clinic, digital twin, and wearable provider
agents effectively prevents unauthorized interaction and enforces institutional policies with manageable overhead. Our findings suggest that neuro-symbolic decentralized governance provides a scalable and trustworthy pathway for safe human-machine collaboration across institutional boundaries.
Read the full abstract ▾
Cryptography and Security
A Decade of Healthcare Cyber Threats: Empirical Analysis, Evidence-Based Prioritisation, and AI Threat Model
Sadia Mehrin Rahi, Ayesha Siddika, Istiyak Hasan Maruf et al. (+3 more)
Healthcare systems face persistent and evolving cyber threats, yet how
adversarial tactics and techniques have shifted over time has not been systematically characterised using empirical, multi-source data. This paper analyses 1,214 threat records drawn from three authoritative sources: the MITRE ATT&CK behavioural framework, the CISA Known Exploited Vulnerabilities catalogue, and the NIST vulnerability database, covering 44 validated healthcare-targeting threat entities from 2017 to 2024. We show that attacker behaviour has shifted measurably toward stealth-oriented tactics: defense evasion remained the dominant tactic throughout the observation period, consistently accounting for 15-20% of observed technique use from 2017 to 2024, while persistence declined from 11.2% to zero and initial access from 9.0% to zero over the same period. We further demonstrate that existing detection guidance is structurally misaligned with where attacker effort is concentrated, with the least-covered techniques receiving the most
adversarial attention. A convergence analysis links 679 confirmed exploited vulnerabilities to a single dominant behavioural technique, identifying a common addressable chokepoint across the vulnerability and behavioural surfaces. Finally, we identify 42 high-priority techniques representing immediate detection opportunities and show that this set of techniques maps directly to emerging threats against AI-integrated clinical systems.
Read the full abstract ▾
All authors Sadia Mehrin Rahi, Ayesha Siddika, Istiyak Hasan Maruf, Adrita Rahman Tory, Muhammad Aminur Rahaman, Khondokar Fida Hasan