Cryptography and Security
NEBULA: A Language - Independent Specification for Opaque Rotating Refresh Tokens
Matteo Teodori
Refresh
tokens are among the most sensitive credentials in modern authentication systems: long-lived, bearer-style, and sufficient to mint access
tokens for days or weeks. RFC 9700, the current Best Current Practice for OAuth 2.0 security, mandates that refresh
tokens issued to public clients be rotated on every use with replay (reuse) detection, or be sender-constrained. But the BCP specifies policy, not mechanism: it prescribes no wire format, no storage schema, no ordering of verification steps, no concurrency contract, and no semantics for edge cases such as lost-response retries or key rotation. Implementations may therefore diverge in precisely the corner cases that determine security outcomes. We present NEBULA, a precise,
language-independent specification of the RFC 9700 refresh-
token model, together with ten conformant reference implementations (TypeScript, Python, Go, Rust, Java, PHP, C#, Ruby, Elixir, Dart). NEBULA
tokens are opaque – a 128-bit public selector and a 256-bit secret verifier, both CSPRNG output, carrying no claims and no signature – so
token validity is a property of server-side state rather than of cryptographic verification. Its conformance methodology publishes the behavioural suite as data rather than as prose: 38 scenarios in one machine-readable file that every implementation executes through a thin per-
language runner, so that drift by transcription is structurally excluded. We describe the specification – including a compare-and-set rotation contract that closes a reproducible bypass of reuse detection under concurrent refresh – analyse its security properties including its post-
quantum posture, and report on cross-
language conformance as a method for multi-implementation security specifications. The specification, implementations, and conformance artefacts are open source under the Apache License 2.0.
Read the full abstract ▾
Cryptography and Security
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
An Khanh Bui, Cong Thanh Nguyen, Hoang-Anh Pham et al. (+2 more)
Personalized
Federated Learning (PFL) has emerged as a promising solution for intrusion detection in heterogeneous IoT environments, as it can improve local adaptation under highly Non-Independent and Identically Distributed (non-IID) data distributions. However, existing PFL methods often rely on client-side self-adjustment, which may lead to over-personalization and substantial degradation in out-of-distribution (OOD) attack detection. In this paper, we propose
Federated Bandit Intrusion Detection (FBID), a novel adaptive PFL framework to address this limitation through server-side personalization control. In particular, FBID employs a contextual multi-armed bandit at the server to dynamically regulate each client's local training intensity according to its observed behavior and update quality. Moreover, FBID introduces a trust-based blending mechanism to derive client-specific interpolation coefficients between the global and local models, thereby preserving global attack-detection knowledge while still allowing beneficial local specialization. Through extensive experiments on the CICIoT2023
dataset under heterogeneous client distributions and OOD stress-test settings, we show that FBID improves individual client OOD Detection Rate (DR) by up to 7.66% and F1-Score (F1) by up to 5.08% (relative) over the strongest stable baseline, while also improving robustness to previously unseen attack classes.
Read the full abstract ▾
All authors An Khanh Bui, Cong Thanh Nguyen, Hoang-Anh Pham, Hoang Thai Dinh, Diep N. Nguyen
Cryptography and Security
An Inline Control Architecture for Language Models in Intelligent Transportation Systems
Narendra Kumar Dewangan and Mounira Msahli
Vehicle-to-everything (V2X) systems increasingly incorporate large
language models (LLMs) for semantic tasks such as message summarization, operator assistance, and decision support at roadside units and edge nodes. Although these components are not part of safety-critical control loops, they introduce
prompt-level attack surfaces that are not addressed by traditional V2X security mechanisms focused on authentication and message integrity. This paper presents Guarded-V2X, an inline semantic guardrail architecture for securing LLM-enabled V2X services under real-time constraints. The proposed system integrates rule-based ingress filtering, a lightweight safety classifier, policy-constrained structured generation, trusted-only
retrieval, and post-decision adjudication to enforce machine-checkable safety boundaries prior to downstream execution. Guarded-V2X is evaluated using a four-stage experimental pipeline encompassing intrusion vulnerability analysis, calibration and latency benchmarking, guardrail validation, and robustness under
adversarial stress. Experiments are conducted on a V2X-aligned simulated
dataset derived from RSU advisories, operator messages, and annotated V2X message summaries. Results show that unguarded and
prompt-only baselines retain residual vulnerability under multi-turn
adversarial trials, while Guarded-V2X consistently reduces intrusion acceptance success rates and eliminates observed unsafe completions in two-turn settings, without exceeding latency budgets for V2X semantic advisory paths.
Read the full abstract ▾
Cryptography and Security
AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection
Shihao Weng, Yang Feng, Xiaofei Xie et al. (+1 more)
Prompt injection remains a critical threat to LLM
agents, yet existing defenses treat each task as a self-contained problem, independent of previous encounters. In practice, user requests are often underspecified: they describe the desired outcome without fully specifying acceptable behavior. An injection can exploit this ambiguity, causing the
agent to complete the task in a way the user would reject. As the user's expectations become clearer through concrete cases, a defense should learn from each encounter and apply what it learns to the next. Inspired by adaptive immunity, we propose AgentAntibody, which equips LLM
agents with a self-evolving immune system against
prompt injection. AgentAntibody represents its evolving understanding of the user's security boundary as a persistent library of antibodies. At runtime, the library recognizes threats to this boundary and mounts corresponding immune responses. Across encounters, it evolves to strengthen the
agent's immunity to future attacks. Extensive experiments across three
benchmarks and four backbone LLMs show that, by learning the user's boundary through experience, AgentAntibody outperforms existing defenses in preventing harmful actions while preserving legitimate task completion, even when the harmful and legitimate actions are both compatible with the stated task.
Read the full abstract ▾
All authors Shihao Weng, Yang Feng, Xiaofei Xie, Jiongchi Yu
Cryptography and Security
When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning
Yiming Chen, Kemou Li, Haiwei Wu et al. (+1 more)
Backdoor attacks in
multimodal contrastive learning (MCL) have garnered growing
attention in recent years, as many downstream tasks critically depend on pre-trained MCL models. Existing detection-based defenses predominantly rely on the CLIPScore metric, under the assumption that poisoned pairs exhibit lower semantic similarity between the image and the caption. However, we identify two critical flaws remaining in existing methods: (1) the substantial overlap between CLIPScore distributions of benign and poisoned pairs undermines the reliability of this metric, and (2) fixed-threshold detection cannot provide statistical guarantees for ambiguous samples within overlapping regions. To overcome these limitations, we propose integrating conformal prediction (CP), a statistical framework that quantifies uncertainty through nonconformity scores (NCSs), to establish provable confidence bounds for detecting poisoned image-caption pairs. Building on CP, we introduce CASCADE, a novel two-stage Coarse-to-Fine Conformal Backdoor Detection framework. The coarse-grained stage uses cross-modality consistency to identify high-confidence benign and poisoned pairs. In the fine-grained stage, a reference set is constructed from high-confidence poisoned pairs, and instance-level NCSs based on text-space similarity are computed for each sample in the unidentified subset. These NCSs measure conformity to the poisoning distribution and enable precise identification of latent poisoned pairs within the unidentified subset. Extensive experiments on the large-scale CC3M
dataset demonstrate that CASCADE achieves an average FPR of 5.79% at 100% TPR and an average AUROC of 0.9867 across diverse attacks, while remaining effective against adaptive attacks.
Read the full abstract ▾
All authors Yiming Chen, Kemou Li, Haiwei Wu, Jiantao Zhou
Cryptography and Security
Beyond the QBER Threshold: A Temporal QBER Based Machine Learning Framework for Multi Attack Detection in BB84 QKD
Isha, Deepak Singh, Devesh Kumar et al. (+3 more)
Conventional BB84
Quantum Key Distribution (QKD) systems rely on a fixed 11%
Quantum Bit Error Rate (QBER) threshold to detect eavesdropping. However, stealthy attacks can remain below this threshold while still compromising channel security. This paper proposes a temporal QBER based machine learning framework for detecting and classifying eavesdropping attacks in BB84 QKD systems. Rather than relying on average session level QBER, the framework extracts 63 physics-informed temporal features capturing burst behavior, temporal instability, basis dependent asymmetry, and QBER loss interactions. Random Forest, XGBoost, and Support Vector Machine with a Radial Basis Function kernel (SVM-RBF) classifiers are evaluated on seven eavesdropping attacks and a normal channel scenario under noisy and lossy conditions. Averaged over ten independent runs, XGBoost achieves the best performance with 88.01% (0.47%) accuracy and a macro F1 score of 0.8803, while SVM-RBF performs comparably, confirming the robustness of the proposed features. Evaluated as a binary attack-versus-normal detector for comparison with conventional monitoring, a fixed 11% QBER threshold achieves only 25.82% accuracy with a False Negative Rate (FNR) of 0.8477, whereas the proposed framework reduces the FNR to 0.0198, substantially improving detection of stealthy attacks that evade threshold-based monitoring. SHapley Additive exPlanations based (SHAP) explainability shows that physics-informed temporal and channel derived features are highly discriminative for identifying eavesdropping strategies. These results demonstrate that temporal QBER driven machine learning provides an accurate, explainable, and practical framework for multi attack security monitoring in BB84 QKD systems.
Read the full abstract ▾
All authors Isha, Deepak Singh, Devesh Kumar, S.K Pal, Praful Hambarde, Amit Shukla
Cryptography and Security · Cross-listed from cs.LG
Robust and Personalized Federated Learning for Aircraft-Engine Prognostics under Benign and Adversarial Client Heterogeneity
Chinmoy Mitra, Md. Mehedi Hasan Nipu, Mohammad Sakib Mahmood et al. (+2 more)
Federated learning (FL) enables aircraft fleet operators to jointly train remaining-useful-life (RUL) models from engine sensor telemetry without sharing raw data. This study examines two complementary challenges: benign heterogeneity, where honest operators observe different operating conditions and fault modes, and
adversarial heterogeneity, where compromised operators submit poisoned updates. We conduct a controlled, safety-oriented evaluation using a multi-task one-dimensional convolutional neural network and a structurally non-IID partition of the Commercial Modular Aero-Propulsion System Simulation (C-MAPSS)
benchmark. We compare four remedies for benign heterogeneity and evaluate five attacks against four aggregation methods, including a physically motivated sensor-value backdoor designed to mask engine degradation. Shared-representation personalization closes approximately 70% of the local-to-centralized root-mean-square-error gap, compared with 21% for proximal regularization and 10% for server-side reweighting. The backdoor achieves a 94.9% attack success rate against standard averaging while leaving clean accuracy statistically unchanged, demonstrating that accuracy alone cannot certify model safety and that attack success must be evaluated explicitly. Krum reduces attack success by an order of magnitude and is the only evaluated aggregator that withstands coordinated attackers, whereas personalization alone provides no protection. Combining personalization with robust aggregation restores robustness (2.8% attack success) with only a small accuracy cost, revealing a trade-off between robust update selection and collaborative representation learning. Results remain consistent across client counts and on a harder six-condition
dataset. Code and data partitions are released for reproducibility.
Read the full abstract ▾
All authors Chinmoy Mitra, Md. Mehedi Hasan Nipu, Mohammad Sakib Mahmood, Md. Rakibul Islam, M. F. Mridha
Cryptography and Security · Cross-listed from cs.CV
Progressive Learning of a Diffusion-based Inpainting Model for Separating Overlapped Fingerprints
Noor Hussein, Anil K. Jain and Karthik Nandakumar
Overlapped friction ridge patterns are a recurring problem in latent fingerprints recovered from crime scenes and in live-scan scenarios where residual fingerprints on the sensor may corrupt subsequent acquisitions. Existing approaches for separating overlapped fingerprints either rely on rule-based orientation field completion that requires strong domain knowledge or train end-to-end deep neural networks that do not account for domain-specific considerations. This work introduces a
diffusion-based pipeline for separating component fingerprints from an image containing overlapping friction ridge patterns. We formulate the separation problem as an inpainting task and progressively learn a
diffusion model for this task in multiple stages. Starting from a pre-trained Stable
Diffusion model, we progressively incorporate a fingerprint prior, add the ability to complete partial fingerprints, and finally propose overlap-aware inpainting that reconstructs each component print using a
diffusion inpainting model based on multi-channel conditioning. Experiments on two public
datasets demonstrate that component fingerprints reconstructed using the proposed
diffusion-based inpainting method can match with their mated counterparts with very high probability.
Read the full abstract ▾
Cryptography and Security
Delay Attacks on the German Smart Metering Infrastructure: A Security Analysis of CLS Channel Timing Constraints
Fabio Stoll, Benjamin Pottkamp, Heiko Lorenz et al. (+3 more)
This work analyzes the feasibility of delay attacks on control signals transmitted via the Controllable Local System (CLS) channel of the German Smart Metering Infrastructure (SMI). It combines theoretical analysis with experimental validation under a threat model aligned to the Common Criteria Protection Profile for the Smart Meter Gateway (SMGW) and assess the potential impact on the power grid if the identified attack vector is exploited across multiple CLS channels simultaneously. We also outline mitigation strategies, including SMGW configuration restrictions, implementation-level changes, and protocol extensions. Our results show that an on-path attacker in the Wide Area Network (WAN) with sufficient contextual knowledge can feasibly execute delay attacks, with a theoretical upper bound of roughly 48 hours for some deployed protocol configurations. Projecting from a single CLS to several hundred thousand CLS devices indicates such an adversary could cause a significant frequency deviation potentially resulting in load shedding. Scaling the attack requires contextual knowledge for each targeted implementation and configuration; whether this knowledge can be broadly reused across CLS channels is uncertain but may become easier to obtain as standardization progresses. Time restricted transmissions in the FNN Steuerbox and in applications using CLS.EEDI are implementation-specific and can therefore be addressed by manufacturers. By contrast, ensuring application-data time limitations in TLS~1.3 requires protocol-level extensions. The TLS extensions proposed here offer a sustainable mitigation while preserving backward compatibility. Other communication channels outside the SMI (for example, proprietary remote terminal units used to control a CLS) are outside this work's scope and may exhibit similar or worse vulnerabilities.
Read the full abstract ▾
All authors Fabio Stoll, Benjamin Pottkamp, Heiko Lorenz, Shalaka Kale, Jessica Rövekamp, Joachim Gerlach
Cryptography and Security
Dependency Triad: A Metric to Quantify the Dependencies Between Attributes for Local Differential Privacy
Sandaru Jayawardana, Sennur Ulukus, Ming Ding et al. (+1 more)
Collecting multidimensional user data is essential for extracting rich insights across various applications. Local Differential
Privacy (LDP) has emerged as a de facto standard for mitigating
privacy risks in such scenarios. A key challenge in
privacy-preserving multidimensional data collection lies in inter-attribute dependencies, as they can inadvertently reveal correlated information and increase
privacy vulnerabilities. Therefore, accurately measuring correlation-induced
privacy leakage (CPL) is essential for
privacy analysis and
privacy-utility trade-off. However, existing CPL analysis solutions either require accurate prior knowledge or face scalability challenges for large numbers of attributes and high-cardinality attributes. These limit their practical applicability in real data. To address this research gap, we propose a novel metric, “Dependency Triad” (DT), which summarizes the pairwise dependency information relevant to CPL using three parameters and yields a constant-time conservative
estimator of pairwise CPL. DT explicitly models uncertainty in prior distributional knowledge through its parameters, delivering robust leakage estimates. Moreover, its robustness to sparse distributions makes it particularly suitable for high-cardinality attributes, while the pairwise formulation serves as a tractable building block for assessing total leakage in multidimensional settings. Extensive experiments on both synthetic and real
datasets demonstrate that DT consistently estimates CPL across diverse dependency regimes and prior uncertainties.
Read the full abstract ▾
All authors Sandaru Jayawardana, Sennur Ulukus, Ming Ding, Kanchana Thilakarathna
Cryptography and Security
When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills
Yongli Xiang, Zhifang Zhang, Bojun Yang et al. (+4 more)
Persona skills distill personal interaction histories into portable and executable artifacts for downstream
agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual records or
retrieval-based
memory. To systematically investigate the safety of the persona-skill pipeline, we introduce AntiSkillBench, an end-to-end
benchmark for evaluating risks and defenses across the persona-skill pipeline. It comprises: (i) a
dataset of 7,500 persona-grounded dialogue traces, constructed from 50 behaviorally rich profiles spanning diverse task scenarios; (ii) an evaluation suite that measures skill-level
privacy leakage and
agent-level attribute disclosure and behavioral impersonation across three skill-
distillation strategies; and (iii) a defense evaluation covering four configurations across online and post-hoc interventions, including active risk suppression and passive provenance protection. Experiments across three frontier
agents show that persona-skill risks persist across
agent backbones and
distillation protocols, extending from explicit attributes to communication styles and personality traits. Existing defenses exhibit limited and
distillation-dependent effectiveness, failing to generalize across risk and
distillation strategies. These results highlight AntiSkillBench as a challenging
benchmark for developing
privacy-preserving and authenticity-aware persona skills.
Read the full abstract ▾
All authors Yongli Xiang, Zhifang Zhang, Bojun Yang, Ziming Hong, Lei Feng, Miao Xu, Tongliang Liu
Cryptography and Security
Empirical Analysis of Evasion and Poisoning Against Malware Data Drift Detection
Mingyue Yang, David Lie and Nicolas Papernot
As concept drift due to malware
evolution presents challenges for malware classification, machine learning-based data drift detection tools are developed to mitigate this problem. These data drift detector tools are designed for a different purpose and built with different techniques compared to malware classifiers. Although evasion and poisoning attacks against machine learning-based malware classifiers can cause misclassification of malware samples, it is not clear how these attacks work against data drift detectors and malware classifiers in combination. This work investigates the effect of evasion and poisoning attacks on the data drift detector along with the malware classifier. We demonstrate how unique characteristics of data drift detectors cause attacks against malware classifiers to work differently against them.
Read the full abstract ▾
Cryptography and Security
A Security-Oriented Lifecycle Model for Large Language Model Systems
Eleftherios Batzolis, George Drosatos, Vassilis Katsouros et al. (+1 more)
Large
language models are being integrated into critical infrastructure and enterprise workflows at unprecedented scale,yet the lifecycle frameworks governing their development and operations were designed for operational efficiency rather than security analysis. As a result, security-relevant activities such as data provenance verification, artifact signing, agentic permission control, and decommissioning are often left implicit or assumed to receive due care. Governance frameworks, in turn, organise requirements around risk levels or management processes without clearly linking them to the lifecycle stages where they apply. This paper addresses both deficiencies. We propose a lifecycle model for LLM systems that supports security analysis by structuring it around security-relevant boundaries rather than workflow optimisation. The model comprises 32 stages across four core pipeline layers (Data, Model, Distribution, Application), supported by a 12-stage LLMOps pillar and a 9-category governance pillar. Thirteen stages are introduced here as separate units because they expose distinct security concerns that existing frameworks do not clearly distinguish. A governance mapping synthesising the NIST AI RMF, the EU AI Act, and ISO/IEC 42001 reveals a structural property of the current regulatory landscape: governance evidence concentrates at deployment-facing stages, where systems are visible to regulators, while the most consequential decisions, data selection,
alignment strategy, and capability boundaries, are made at development-facing stages, where regulatory visibility is lowest.
Read the full abstract ▾
All authors Eleftherios Batzolis, George Drosatos, Vassilis Katsouros, Konstantinos Rantos
Cryptography and Security
DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction
Xuyang Liu, Yibin Han, Zhenwei Zhang et al. (+8 more)
Large
Language Model (LLM)
agents offer a promising approach to attack chain reconstruction by retrieving and interpreting heterogeneous telemetry to infer ordered attacker actions. However, existing
benchmarks mainly evaluate final outputs or aggregate accuracy, providing limited insight into how errors arise and propagate across intermediate
reasoning stages. We present DiagChain, a diagnostic
benchmark for evidence-grounded attack chain reconstruction that enables stage-wise evaluation of LLM
agents. DiagChain includes MAIN-69, a suite of 69 scenarios spanning multiple operating systems, evidence noise levels, and chain lengths. It further introduces Evidence-Centric
Retrieval-Augmented Generation (ECRAG), which couples evidence
retrieval with an evolving structured representation of the reconstructed chain. Five complementary metrics are introduced to assess distinct stages of the reconstruction process and support systematic failure diagnosis. Based on evaluations using 6 LLMs, DiagChain reveals that even the strongest configuration succeeds on only 39.6% of the 849 reference steps in MAIN-69. Our analysis further shows that smaller models struggle with the more basic task of incorporating retrieved evidence into their outputs, whereas larger models can proceed to later steps, where correctly ordering that evidence becomes the main bottleneck. These results validate the importance of diagnostic evaluation beyond end-to-end accuracy and provide actionable insights for improving evidence-grounded cybersecurity
agents.
Read the full abstract ▾
All authors Xuyang Liu, Yibin Han, Zhenwei Zhang, Kai Chang, Zhiwei Xu, Tian Qiu, Weixian Deng, Jiabao Gao, Xiaolin Peng, Hai Wan, Xibin Zhao
Cryptography and Security
Secure Long-Range Autonomous Valet Parking: A Reservation Scheme With Three-Factor Authentication and Key Agreement
Di Wang, Yue Cao, Fei Yan et al. (+3 more)
Long-range autonomous valet parking (LAVP) is increasingly adopted to alleviate traffic congestion and parking difficulties. For large-scale parking demand, reservation can improve parking management. However, existing schemes mainly focus on parking request verification and parking check-in, and do not adequately protect identity legitimacy and communication security during passenger drop-off and pick-up. To address this problem, we propose SecLAVP, a provably secure three-factor authentication and key agreement protocol for LAVP reservation services. SecLAVP combines passwords, biometrics, and smart cards. With assistance from the drop-off/pick-up point (DP), the passenger and the autonomous vehicle (AV) achieve mutual authentication and establish a session key for secure communication. In the Real-Or-Random (ROR) model, we formally prove that SecLAVP provides session-key security. AVISPA simulations show that SecLAVP resists man-in-the-middle attacks, while informal analysis demonstrates that it satisfies 15 defined security goals. Finally, performance evaluation in terms of communication overhead, computational overhead, and scheduling shows that SecLAVP is feasible for practical deployment.
Read the full abstract ▾
All authors Di Wang, Yue Cao, Fei Yan, Yining Liu, Daxin Tian, Yuan Zhuang
Cryptography and Security
CAN Disabler: Hardware-based Prevention method of Unauthorized Transmission in CAN and CAN-FD networks
Ryo Kurachi, T. David Pyun, Shinya Honda et al. (+3 more)
There have been a quite number of security attack cases against Controller Area Network (CAN) reported in recent years, but in the meantime no security function is included in the ECU in the current in-vehicle control network. Thus, in-vehicle control networks particularly require cost-effective security features. In this paper, therefore, we propose a method to block unauthorized CAN-bus access using a CAN controller that is modified to prevent the ECU from transmitting messages to the CAN-bus at abnormal frequency. Then, we have also demonstrated the effectiveness of the disabler on CAN with flexible data-rate (CAN-FD) buses.
Read the full abstract ▾
All authors Ryo Kurachi, T. David Pyun, Shinya Honda, Hiroaki Takada, Hiroshi Ueda, Satoshi Horihata
Cryptography and Security
ReputationChain: Robust Trust Updating for Blockchain-Enabled Supply Chains
Adnan Iftekhar, Chengliang Zheng, Xiaohui Cui et al. (+1 more)
Blockchain can preserve supply-chain records, but ledger integrity alone does not show whether a participant should be trusted in a future risk-sensitive transaction. Existing reputation systems mainly address product evidence, global feedback aggregation, or review authenticity, while giving less
attention to repeated bilateral inflation, identity multiplicity, and unfair decay for honest participants with sparse histories. We present \RC, a participant trust framework that uses blockchain as an evidence and provenance layer rather than as the source of trust. Governed interaction outcomes are converted into bounded evidence. Repeated interactions between the same pair are discounted, low counterparty diversity is penalized, governance-supplied identity confidence weights positive evidence, and scores decay toward a neutral prior according to verified interaction volume. Identity, contract, outcome, and update provenance remain on chain, while nonlinear reputation computation is performed off chain and checked on chain for admissibility. In controlled simulations with 30 seeded runs and matched interaction traces, the full model reduces mean collusive gain to 0.1443, compared with 0.3688 for naive mean evidence and 0.3585 for static decay. With ten identities under one controller, the reputation inflation ratio falls to 0.8723, while three comparison baselines remain above 1.08. On identical newcomer traces, volume-aware decay increases mean newcomer reputation from 0.6626 to 0.7589 and reduces the false low-trust rate from 0.3633 to 0.1683. Paired analysis confirms these improvements across runs. The results support a bounded reduction in reputation distortion, not attacker detection. Deployment evaluation and calibration with operational data are still required before production use.
Read the full abstract ▾
All authors Adnan Iftekhar, Chengliang Zheng, Xiaohui Cui, Mir Hassan
Cryptography and Security
A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End
Anton Sokolov
When an automated
agent (an AI
agent, say) takes a consequential action, the record it leaves behind is produced by the very software stack whose integrity is in question. A signed log proves which key wrote the record, not what the runtime was. Prior work proposed treating that record (an Action Evidence Package, AEP: a signed append-only record of an action, its authorising principal, and its outcome) as application-layer Evidence under the IETF Remote ATtestation procedureS (RATS) architecture (RFC 9334), binding the outcome into a hardware-rooted TPM quote so that swapping it invalidates the quote. But that prior work appraised the result only against a minimal Verifier stand-in. This article closes that gap. We drive an AEP quote, produced on an emulated software TPM, end-to-end through a conformant Project Veraison RATS Verifier. We generate an EC P-256 attestation key, measure the AEP outcome digest into a PCR, pack a genuine quote into Veraison's tpm-enacttrust format, provision a Concise Reference Integrity Manifest (trust anchor plus golden reference value), and obtain a signed EAT Attestation Result (EAR). Good evidence yields affirming; an outcome-swap or a one-byte signature tamper yields contraindicated. Along the way we uncover, responsibly disclose, and fix a security-relevant finding: the reference scheme does not enforce challenge-nonce freshness, so a replayed quote still appraises as affirming. We give an exact, upstreamable two-part fix and validate it end-to-end. With the fix active, the same valid quote that is affirming in its own session flips to contraindicated when replayed to a fresh one. The pipeline is fully reproducible; the Attester remains an emulated swtpm, not a hardware guarantee.
Read the full abstract ▾
Cryptography and Security
AI Forensics Across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems
Ali Dehghantanha and Sajad Homayoun
AI systems are increasingly involved in decisions and actions that may later require investigation. When an AI related incident occurs, investigators need to reconstruct what the system did, why it behaved that way, and which part of the system or supply chain contributed to the outcome. Existing work on AI forensics remains fragmented, often focusing on a specific system type, artifact, or analysis technique. This paper argues that investigator access is a useful starting point for organizing the field. We distinguish white box, grey box, and black box access and show how each access level changes what can be collected, preserved, analyzed, and reported. Based on this distinction, we propose a process model
matrix for AI forensics across four phases: collection, preservation, analysis, and reporting. We also introduce an order of
volatility for AI systems, covering runtime state, context windows, logs,
retrieval stores, model artifacts, and training lineage. From this
matrix, we derive an access conditioned examination framework and identify open research problems, including black box preservation, model version attestation, uncertainty quantification for surrogate based analysis, and chain of custody for mutable AI artifacts.
Read the full abstract ▾
Cryptography and Security
SkillJack: Persistent Skill Backdoors in Self-Evolving Agents
Zonghao Ying, Xiangfan Wu, Huiyu Wu et al. (+4 more)
Self-evolving
agents increasingly convert interaction histories into reusable skills that persist beyond individual tasks. While prior work studies
memory and
retrieval poisoning, such attacks only affect
agents when poisoned records are retrieved as context. We uncover a new and more fundamental risk: poisoned experiences can be transformed by the
agent itself into durable behavioral artifacts. We present SkillJack, the first attack that exploits the experience-to-skill pipeline of self-evolving
agents. Instead of directly manipulating runtime context, SkillJack hijacks the
agent's own learning process to implant malicious behaviors into its reusable skill repertoire. We identify three key properties of this transformation: sanitization whitewashing, where malicious intent is obscured during skill extraction; cross-layer promotion, where transient experiences become persistent capabilities; and persistence isolation, where the attack survives removal of its original source records. We evaluate SkillJack on two representative systems, SkillX and Anything2Skill, using a shared
dataset of 150 trajectories across four policy-risk categories. Results show that skill extraction substantially reduces attack detectability: in SkillX, safety detection drops from 98.5% for poisoned trajectories to 11.4% for extracted skills, while Anything2Skill shows a similar effect. Meanwhile, the implanted skills remain effective, achieving attack success rates of 56.2% and 89.2% on the two systems, respectively. Furthermore, 80.0% of skill-mediated attacks persist after deleting the original poisoned records, and some skills unintentionally activate on benign queries. Our findings reveal skill
evolution as a new attack surface and motivate provenance-aware skill lifecycle protection. Our code is available at https://github.com/Tencent/AI-Infra-Guard/research/skilljack.
Read the full abstract ▾
All authors Zonghao Ying, Xiangfan Wu, Huiyu Wu, Xing Zheng, Huangsheng Cheng, Xiaorong Shi, Jing Guo
Cryptography and Security
SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
Nizhang Li, Zonghao Ying, Xiangfan Wu et al. (+7 more)
External skills extend the capabilities of large
language model
agents, but also introduce an execution-time attack surface: a skill that appears benign under inspection may reveal harmful behavior only after particular environmental states, resources, or interaction histories are encountered. Existing scanners primarily rely on static analysis, predefined rules, or one-shot semantic judgments, making such conditional behavior difficult to elicit and attribute. We present SkillSentry, a dynamic safety-testing framework based on adaptive honey worlds. SkillSentry infers the intended capability boundary of a skill, constructs an LLM-simulated environment with controlled decoy resources, and adaptively generates tasks to explore its behavioral states. It then compares skill-enabled trajectories with matched no-skill executions, grounding suspicious behaviors in source code and verified execution traces before making a final decision. We evaluate SkillSentry against seven scanner configurations. SkillSentry achieves 99.50% Recall and 96.26% average F1 on standard
benchmarks. Under semantics-preserving evasion, it reaches 92.95% average F1, compared with 80.07% for the strongest baselines. Our code is available at https://github.com/nizhangli062-jpg/SkillSentry-Adaptive-Honey-Worlds-for-Dynamic-Safety-Testing-of-
Agent-Skills.
Read the full abstract ▾
All authors Nizhang Li, Zonghao Ying, Xiangfan Wu, Zonglei Jing, Xixun Lin, Hao Zhang, Wenxin Zhang, Jiaye Lin, Quanchen Zou, Xiangzheng Zhang
Cryptography and Security
Breaking ACDGV MinRank Gabidulin encryption schemes over matrix codes
Thai Hung Le
Enhanced Gabidulin
Matrix Codes (EGMC), introduced by Aragon, Couvreur, Dyseryn, Gaborit, and Vincotte at Asiacrypt 2024, were designed to hide the algebraic structure of Gabidulin
matrix codes while enabling very compact McEliece- and Niederreiter-type encryption schemes, with ciphertexts as small as 65 bytes at the claimed 128-bit security level. Their security relies on the assumption that a masked EGMC code is hard to distinguish from a random
matrix code. We show that this enhanced construction leaves enough structure for an equivalent code of the secret key to be recovered. Unlike previous cryptanalysis, our attack combines combinatorial and algebraic techniques to recover a Gabidulin-equivalent compressed code. This code can then be extended to a full-length equivalent secret key in
polynomial time. As a result, the attack provides both a distinguisher and a key-recovery attack against the EGMC encryption schemes. The attack breaks all 16 proposed EGMC parameter sets by large margins. For example, for the claimed 128-bit parameter set (2,17,37,4,0), it reduces the security level from 186 bits to 35 bits and in our implementation, the equivalent secret key of this parameter set is recovered in less than 10 minutes.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Provably Learning Multi-Head Attention with Queries
Sunyeop Kim and Insung Kim
We study the problem of learning multi-head softmax
attention from black-box input-output access. The learner may query arbitrary real-valued
token sequences and observe only the scalar output at the final
token. Recent work gives an
algorithm using $O(d^2)$ value queries to recover the single-head parameters $(W,v)$. For multiple heads, the same work establishes identifiability under the assumption that the heads occupy pairwise orthogonal subspaces. Applying the single-head recovery
algorithm separately to the heads additionally requires bases for these subspaces to be known. We recover a canonical representation by merging heads with the same $W_h$, summing their corresponding $v_h$, and discarding a merged head when this sum is zero, without these subspace assumptions. By varying the number of copies of a
token, our
algorithm obtains samples of a rational function whose interpolation separates the canonical heads. Additional queries formed by adding selected
token vectors then match the same head across different queries. When the oracle outputs and all subsequent computations are exact, the learner chooses its query vectors at random and recovers the canonical pairs $\{(W_h,v_h):h\in[H]\}$ up to permutation with probability one. When $H$ is known, it uses exactly $4Hd^2-2H+1$ value queries of maximum length $2H+1$. If only a known upper bound $H_0$ is available, the
algorithm uses $4H_0d^2-2H_0+1$ value queries of maximum length $2H_0+1$. For approximate oracle outputs, we give conditions under which the parameter error is at most a model- and query-dependent constant multiple of the output error. Finally, we extend our result to a one-layer
Transformer with multi-head
attention followed by a bias-free ReLU feed-forward network. Under additional conditions, we recover a functionally equivalent
Transformer without relying on a separate
algorithm for learning the feed-forward network.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Noise-Aware Shrinkage for Differentially Private Zeroth-Order Fine-Tuning of Large Language Models
Lele Zheng, Weifeng Kong, Xinyi Zhang et al. (+3 more)
Differentially private zeroth-order optimization (DP-ZO) enables
memory-efficient private fine-tuning of large
language models using only forward evaluations. Existing aggregation-based DP-ZO methods reconstruct model updates at a fixed scale, ignoring that the strength of useful signals varies throughout training. Consequently, noise-dominated updates may receive excessive weight and degrade model utility. To address this issue, we propose SAGE, a noise-aware shrinkage method that adaptively attenuates privatized estimates according to their estimated signal quality. SAGE subtracts the known Gaussian noise variance from the observed second moment to estimate the underlying signal energy, stabilizes this estimate through temporal tracking, and compares its current signal-to-noise level with a warm-up reference to derive a bounded shrinkage factor. As pure post-processing, SAGE requires neither additional
privacy budget nor model queries and introduces only constant additional state. Our theoretical analysis shows that shrinkage reduces the quadratic update-risk term faster than the linear descent term, preserving useful descent while limiting the influence of noise-dominated updates. Experiments on RoBERTa-large, OPT-1.3B, and OPT-6.7B demonstrate that SAGE outperforms existing baselines in most settings under the same
privacy budgets while preserving the forward-only
memory efficiency of DP-ZO.
Read the full abstract ▾
All authors Lele Zheng, Weifeng Kong, Xinyi Zhang, Ke Cheng, Tao Zhang, Yulong Shen
Cryptography and Security · Cross-listed from cs.LO
Right Divisibility in Erasing Semi-Thue Systems: A Minimal View of Intruder Deduction
Raja O. P. Damanik and Alwen Tiu
The intruder deduction problem is central to symbolic security-protocol analysis: it asks whether an attacker can derive a target message from observed messages using (cryptographic) operators available to the attacker. Although convergent rewrite systems provide canonical normal forms, deduction modulo convergent theories remains undecidable in general, and existing decidable fragments are often shaped by practical cryptographic examples. In this paper, we study deduction from a minimal structural perspective. When all function symbols are unary, terms collapse to words and deduction becomes a right-divisibility problem for semi-Thue systems: given words $u$ and $v$ decide whether there exists $w$ such that $wu \equiv_S v$. We investigate this problem for several classes of semi-Thue systems and prove, to the best of our knowledge, new decidability results for convergent prefix-erasing and convergent suffix-erasing systems. We then extend this perspective to term rewriting systems whose rules erase contexts while lifting selected subterms or variables. Although these classes suggest possible decidable generalisations beyond the unary setting, we show that deduction is already undecidable for a convergent simultaneous variable-lifting system. This exposes both the potential and the limits of extending the right-divisibility results to richer equational theories.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.IR
Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity
Anjun Hu, Hanting Xie, Saranya Govindan et al. (+2 more)
Multi-
agent collaborative filtering (CF) systems coordinate autonomous LLM-powered user and item
agents through natural-
language interaction to refine preferences and generate recommendations. These systems inherit vulnerabilities from both their data-driven nature and their multi-
agent interactions, which manifest in distinct ways. Understanding how connectivity modulates vulnerability in these systems could facilitate the development of more robust recommendation pipelines. In this work, we adapt attacks and defenses from the general multi-
agent systems (MAS) literature to the
agent-based CF setting, evaluating them under systematically varied connectivity in the AgentCF framework, where CF connectivity is characterized along two axes: (i) candidate count (the number of item candidates per turn per user, measuring user-side interaction density) and (ii) catalog concentration (the degree of item catalog overlap across users). Our contributions include: (1) Adaptation: we reproduce MAS-inspired attacks and defenses in the agentic CF domain, confirming partial transferability of original observations. (2) Characterization: we characterize how the two aspects of connectivity shape attack and defense outcomes, revealing role asymmetries between user and item
agents, non-monotonic temporal dynamics in attack efficacy, and divergent patterns across dissemination and extraction attack goals. Additionally, as an exploratory extension, we assess the applicability of epidemic-inspired static metrics in ranking CF configurations by expected attack outcome, potentially enabling cost-efficient robustness assessment. Implementation is available at https://github.com/anjunhu/ConnACF
Read the full abstract ▾
All authors Anjun Hu, Hanting Xie, Saranya Govindan, Jas Kandola, Kurt Cutajar
Cryptography and Security
FedGSA: Geometry-Consistent Subspace Aggregation for Differentially Private Federated LoRA
Lele Zheng, Ruijie Hu, Tao Zhang et al. (+2 more)
Low-Rank Adaptation (LoRA) enables communication-efficient
federated fine-tuning of pretrained
language models. However, integrating differential
privacy (DP) into
federated LoRA remains challenging: independently perturbing and aggregating its two low-rank
matrices can cause aggregation mismatch and the quadratic noise term. Existing methods mitigate these issues by freezing one low-rank
matrix but still rely on Euclidean aggregation, which is basis-dependent and may distort the global update. To address this limitation, we propose FedGSA, a geometry-consistent aggregation framework for differentially private
federated LoRA. FedGSA represents each privatized client update as a basis-invariant subspace on the Grassmann
manifold. In each communication round, clients extract low-dimensional subspaces capturing dominant update directions and encode them as projection
matrices. The server aggregates these representations to estimate a geometry-consistent global update subspace and reconstructs the global LoRA factors within it, reducing distortion caused by basis misalignment,
privacy noise, and heterogeneous client updates. We prove that FedGSA incurs no additional
privacy loss beyond client-side DP training and establish its convergence under standard assumptions. Experiments on four GLUE tasks and a
language generation
benchmark demonstrate consistent improvements across
privacy budgets and degrees of data heterogeneity. In particular, FedGSA improves average accuracy over the strongest baseline by 2.17% and 2.27% under $\epsilon=6$ and $\epsilon=3$, respectively.
Read the full abstract ▾
All authors Lele Zheng, Ruijie Hu, Tao Zhang, Ke Cheng, Yulong Shen
Cryptography and Security
ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection
Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil et al. (+4 more)
The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on official app stores, many malicious applications successfully evade detection by concealing sophisticated malware variants. These malicious behaviors are often activated only during runtime, making them difficult to identify through conventional static analysis. As a result, malware may remain undetected until after installation, potentially causing irreversible damage to users and their devices. This study presents a real-time Android malware detection framework that analyzes application behavior to accurately identify and classify complex malware. The proposed approach employs a hybrid dynamic analysis technique to distinguish malicious applications from benign ones. After preprocessing and filtering the collected
dataset, the applications are classified using multiple machine learning
algorithms. A comprehensive performance evaluation is conducted to compare the effectiveness of different classification techniques in terms of detection accuracy and execution time. Experimental results demonstrate that a hybrid model combining Random Forest and a Multilayer Perceptron achieves the best overall performance, attaining an accuracy of 97.5% with an execution time of 22.945 seconds. The proposed framework can enhance mobile device security by enabling timely detection of malicious applications and reducing the risk of cyberattacks.
Read the full abstract ▾
All authors Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil, Ahmed Ann Noor Ryen, Arman Hossain, Faisal Bin Ashraf, Muhammad Iqbal Hossain
Cryptography and Security
MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories
Jian Zhao, Shenao Wang, Qingyang Wu et al. (+3 more)
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registries and open-source platforms. Existing detection approaches, including heuristic-, learning-, and LLM-based methods, suffer from
language-specific designs, limited generalization, and high analysis costs, making them unsuitable for large-scale multi-
language analysis. To address these challenges, we propose MalTotal, a scalable and cost-effective framework for
language-agnostic malicious code detection. MalTotal leverages LLM-assisted semantic
reasoning to identify sensitive APIs, perform hybrid semantic slicing, and reconstruct malicious behavior contexts while reducing analysis overhead. Our evaluations show that MalTotal outperforms 8 state-of-the-art baselines, achieving an average F1-score of 93.1% across 5 mainstream
languages. Its hybrid slicing reduces LLM
token consumption by 94.0%, lowering the analysis cost from \$86.25 to \$5.19 on 2,168 repositories. In a large-scale study of 120K GitHub repositories containing over 7.3 million files, MalTotal discovered 564 previously unknown malicious repositories across multiple
languages at a total cost of \$338. These results demonstrate the effectiveness, scalability, and cost-efficiency of MalTotal in mitigating large-scale code poisoning attacks.
Read the full abstract ▾
All authors Jian Zhao, Shenao Wang, Qingyang Wu, Yanjie Zhao, Xiao Cheng, Haoyu Wang
Cryptography and Security
Attribute-based Undetectable Watermarking for Generative AI Models
Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel et al. (+1 more)
Generative AI systems increasingly produce content whose provenance is difficult to verify, motivating watermarking techniques for identifying model-generated outputs. Existing cryptographic watermarking methods provide strong undetectability guarantees: without a detection key, watermarked outputs are computationally indistinguishable from unwatermarked ones. However, these approaches do not address the crucial deployment challenge of how to safely delegate detection capabilities. With an unrestricted detection key, a malicious detector may use the detection key beyond its intended scope, enabling watermark sanitization, scope abuse, and user profiling. To mitigate this safety concern, we introduce, to the best of our knowledge, the first attribute-based watermarking for generative AI models, providing fine-grained, policy-controlled watermark detection. In our approach, each generated output is associated with attributes, and each detection key is constrained by a policy on potential attributes. A detection key can only be used to detect watermarked outputs whose attributes satisfy the corresponding policy, while watermarked outputs that fall outside the policy remain computationally indistinguishable from unwatermarked ones. We construct such an attribute-based watermarking scheme and formalize its security properties, including consistency, adaptive robustness to bounded corruptions, undetectability, and soundness, along with a security proof under standard cryptographic assumptions. Our construction integrates constrained pseudorandom functions, pseudorandom error-correcting codes, and randomness recovery procedures with generative AI models. Finally, we implement a prototype and an empirical evaluation, demonstrating that attribute-based watermarking is both effective and practical.
Read the full abstract ▾
All authors Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel, Er-Cheng Tang