Cryptography and Security
Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards
Haoyu Zhang, Yi Feng, Shibo Zheng et al. (+6 more)
When an encoded attack passes a content guard, the guard either never represented the payload's harmful content or represented it and failed to act. End-to-end attack success rate reports one number for both, yet the two have opposite remedies: one is a representational limit that more verdict-level safety training cannot reach, the other is a decision rule that it can. We separate them by reading a guard's own residual stream, using a content probe fitted on plaintext and transferred without refitting to the encoded condition, alongside the verdict logits from the same pass. Licensing that read honestly is most of the problem and is our main contribution. A conventional permutation test admits the decode measurement on most of a 19-condition encoding ladder for each of two open guards. A length-matched null and a floor calibrated on conditions the guard's base model decodes at rate zero reduce it to four conditions each; holding out the items the probe was fitted on removes one more. A further screen constrains the block axis by running plaintext content inside each condition's own wrapper. It removes the largest surviving
cell. What remains is a policy failure that survives an item-level holdout on the zero-width encoding for both guards, at 8 and 7 per 100
prompts, against 17 and 23 when the probe is allowed to have seen the
prompt it is scoring. It is also confined to one family of surface encodings: where an encoding leaves content linearly recoverable we can separate the two failures, and on genuine ciphers we report the
cells as unmeasured rather than as evidence that nothing was decoded. Across every guard and condition pair except two, both unmeasured on the decode axis, blocked without decoding is near zero, so we find little evidence for a pure encoding-format detector under the conditions we test. That
cell is the one read we do not repeat under the holdout.
Read the full abstract ▾
All authors Haoyu Zhang, Yi Feng, Shibo Zheng, Hanwen Liu, Haowen Xu, Xiao Luo, Zhuoxi Wang, Mohammad Zandsalimy, Shanu Sushmita
Cryptography and Security
Refusing Everything Looks Safe: Restoring the Benign Arm to Encoded-Prompt Evaluation
Haoyu Zhang, Haowen Xu, Xiao Luo et al. (+7 more)
Encoded-
prompt attacks are evaluated almost entirely on their harmful arm: a
benchmark sends obfuscated harmful requests and reports how often the model complied. A high refusal rate there is reported as safety, and it is equally consistent with a model that has stopped telling the request apart from anything else in the same format. We run the benign arm through the same transformation, and the two cases are far apart. Across four 7-8B models spanning three base families and four post-training recipes, refusal of harmful homoglyph-encoded
prompts spans 0.08 while the same four span 0.57 on the identical requests in plaintext. What the encoding destroys is not refusal but the harm gap: on one model the gap between harmful and benign refusal falls from +0.82 in plaintext to exactly 0.00 under the encoding, and a
benchmark reading only the harmful arm scores that model and one retaining a +0.61 gap identically. Running the
cell such
benchmarks leave out (plaintext content wearing the attack template, with nothing obfuscated) shows that on two of the four models the loss is caused by the protocol rather than by the character transformation, and on a third by the characters. Across a full SFT -> DPO -> RLVR pipeline the harm gap rises by +0.26 with a paired interval excluding zero while the standard harmful-arm metric registers no resolved change at all. We report twelve instrument defects, each with the control that caught it, including a binary jailbreak judge that fires on 0.61-0.70 of responses to plaintext benign
prompts; six of the twelve inflate apparent safety, which is the direction a broken safety evaluation fails in by default.
Read the full abstract ▾
All authors Haoyu Zhang, Haowen Xu, Xiao Luo, Hanwen Liu, Yang Chen, Zijian Xiao, Yi Feng, Xiangchen Guan, Mohammad Zandsalimy, Shanu Sushmita
Cryptography and Security
The Uncontrolled Variable: Vision-Language Refusal Is Conditioned on the Image-Attachment Interface, and Not Robust to Irrelevant Image Properties
Haoyu Zhang, Yi Feng, Hanwen Liu et al. (+7 more)
We show that aligned
vision-
language models also condition refusal on a property of a request's form: whether an image is attached, holding everything the request asks fixed. Attaching a blank canvas, an image that cannot be read, cannot relate to the request, and is byte-identical across every
prompt in its condition, shifts benign refusal by tens of points. The shift is not blanket caution but a threshold shift: genuinely neutral instructions are almost unaffected (<=2 percentage points on three of four hosted models) while borderline-benign
prompts move +23 to +51 points, so the cost falls on sensitivity-adjacent traffic, meaning benign questions about
privacy, self-harm, violence and illegal activity. There is a benign reading of such a threshold, namely that attachment correlates with risk in real traffic, and we take it seriously; a black-box study cannot measure that correlation and we do not claim to. What it can test is whether the response to attachment is robust to variation carrying no information about the request, and on four independent measurements it is not. It varies with canvas colour and pixel count. Its sign inverts across checkpoints. It survives an explicit instruction to disregard the image. And on one model it fires on a bare assertion that an attachment exists, with nothing attached and the modality word contributing none of it. Finally we price it. On a matched harmful set the same canvas does lower attack success, so the cue buys something. But the charge is decoupled from the purchase: the checkpoint with the least harmful headroom we measure, completing only 2% of plain harmful requests, still pays the benign cost in full, and across our models the harmful-side denominator falls as
alignment improves while the benign cost does not track it down. Image presence is not a conservative default that a deployer chose and priced. It is an uncontrolled variable.
Read the full abstract ▾
All authors Haoyu Zhang, Yi Feng, Hanwen Liu, Shibo Zheng, Zhuoxi Wang, Yang Chen, Haowen Xu, Xiangchen Guan, Mohammad Zandsalimy, Shanu Sushmita
Cryptography and Security
SoK: From Generation to Consumption of Privacy Documents in Software Systems
Shidong Pan, Clark LaChance, Zhen Tao et al. (+1 more)
Privacy documents (e.g.,
privacy policies) are a central mechanism through which digital services disclose data practices and seek user consent. Over the past decades, research on
privacy documents has expanded significantly, encompassing not only traditional
privacy policies but also short notices (e.g.,
privacy labels) and interface-level transparency mechanisms. As this research area continues to grow, it has become increasingly difficult to obtain a coherent view of how
privacy documents are created, analyzed, evaluated, and maintained across their lifecycle. This SoK provides a unified, lifecycle-oriented view of
privacy documents from a software engineering perspective. We systematically review and analyze 290 papers published between 2010 and 2025, organizing them around five research questions that examine how
privacy documents are (1) defined and scoped, (2) generated, (3) analyzed and extracted, (4) checked for inconsistencies and noncompliance, and (5) evaluated and improved for usability. Building on our findings, we identify 15 key research trends and 21 open opportunities. We further chart four broader research directions that highlight (i) emerging challenges in AI-centric platforms, (ii) the need for diverse and up-to-date data foundations, (iii) LLM-based unified policy-code analysis, and (iv) dual usability for end-users and developers. We hope this SoK provides a shared foundation for future research on
privacy policies and
privacy documents.
Read the full abstract ▾
All authors Shidong Pan, Clark LaChance, Zhen Tao, Sepideh Ghanavati
Cryptography and Security
Non-Degenerate Risk Certification for Automated Security Decisions: A Decision-Contract Theory with ATT&CK-Aligned Triage as a Worked Instance
Zhenpeng Li
An unconditional risk bound on automated decisions can be satisfied without automating anything, since a selector that never acts drives the bound to zero. We show this is structural: any risk certificate is defined over a decision contract, the inputs a system acts on plus the semantic relation under which an output counts correct, and weakening either hides base-classifier error. We develop a decision-contract theory: an error-conservation law showing error is only reassigned among harmful automation, human deferral, and semantic masking; a label-free singleton capacity certifying structural incapacity, with a risk-feasible refinement separating recoverable threshold misalignment from risk-constrained incapacity; and a non-degenerate actionability certificate excluding all-abstain solutions by construction. We instantiate this on ATT&CK-aligned alert triage for LLM-based intrusion detection, the setting that exposed the vacuity failure. Across 3 IDS
datasets, 6 LLMs, and 4 error-rate thresholds, empirical false-attribution risk stays at or below target in 90.3% of configurations, with 83.4% mean correct automation. The capacity diagnostic explains every low-utility configuration; its refinement separates genuine misalignment from risk-constrained incapacity, confirmed by an exhibited alternative threshold; a training-stability re-run finds no confirmed structural-incapacity instance; and real fine-grained attack-subtype labels confirm the coarsening-transfer identity under a genuine many-to-one map, with small but non-zero masking mass.
Read the full abstract ▾
Cryptography and Security
The energetic cost of mitigating AI attacks in cellular networks
Adrián Losada, Hao Qiang Luo-Chen, David Segura et al. (+4 more)
The integration of Artificial Intelligence (AI), generally as Machine Learning (ML)
algorithms, in all levels and aspects of cellular networks demonstrates the success of data-driven
algorithms; for example, the
Radio Intelligence Controller (RIC) of the O-RAN paradigm bestows the network with optimised
radio resource allocation, load balancing or energy efficiency functions, among others. Nevertheless, this dependency on data opens new security vulnerabilities, as attackers can alter data properties and steer ML models to underperform or degrade. Conversely, the developed mitigation strategies are effective, but they generate a computational load which, in consequence, results in an energy cost generally overlooked, even in the current energy-awareness context. In this work, consumption of a defence technique is characterised, and the challenges raised by the triad of ML accuracy, robustness and energy efficiency are outlined.
Read the full abstract ▾
All authors Adrián Losada, Hao Qiang Luo-Chen, David Segura, Carlos S. Alvarez-Merino, Milan Groshev, Emil J. Khatib, Raquel Barco
Cryptography and Security
Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents
Junliang Liu, Ruoyu Li, Wenxin Tang et al. (+4 more)
LLM
agents increasingly rely on third-party skills, using natural-
language descriptions for selection and instruction bodies for planning. This progressive-disclosure design exposes two sequential control points to untrusted publishers: a static skill may steer an otherwise correct task onto an unnecessarily costly trajectory. Prior work studies selection manipulation, malicious skill instructions, and tool-chain resource amplification largely separately, leaving their end-to-end composition unclear. We introduce Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack that couples these stages. Under shared semantic cover, a description establishes relevance during selection, while an aligned body reuses that rationale to fabricate plausible dependencies during planning. CDH attracts an attacker-controlled coordinator alongside legitimate skills, recruits unnecessary benign skills into a bounded detour, and then re-enters the original route to preserve task completion. We evaluate it across multiple LLM backends and 491 held-out tasks under single-task and multi-turn conditions. On DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks; among coordinator-hit runs that complete tasks,
token consumption and end-to-end execution time increase by 66.91% and 92.45%, respectively, while aggregate task completion remains comparable. Thus, correct outcomes do not guarantee trajectory integrity or cost safety.
Read the full abstract ▾
All authors Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao, Zhenyu Liu, Jingheng Xu, Laizhong Cui
Cryptography and Security
VICBench: A Multi-Language Benchmark for Code Vulnerability Detection
Jin Lu, Xuening Han, Yang Zhong et al. (+4 more)
Evaluating security vulnerability detection tools requires
benchmark datasets with vulnerability-inducing commits (VICs) - the commits that first introduce vulnerabilities into codebases. VICs are essential for determining the full range of vulnerable software versions. Existing vulnerability
datasets suffer from limited programming
language coverage, restricted patch complexity, and narrow project scope. Through our dual annotation by human experts and an agentic workflow, we create a
benchmark - VICBench - of 100 verified VICs for 100 CVEs across 88 projects in Python, Java, and C++, covering 48 CWE types. VICBench features complex real-world vulnerability fixes averaging 38.6 lines and corresponding VICs of 252.5 lines - significantly larger than prior work. Our evaluation shows that state-of-the-art
algorithms V-SZZ and LLM4SZZ achieve only 33.3%-40.1% F1, confirming that using existing approaches still entails significant manual effort. VICBench enables robust evaluation of vulnerability detection approaches.
Read the full abstract ▾
All authors Jin Lu, Xuening Han, Yang Zhong, Lin Tan, Kevin Luo, Andrew Gacek, Neha Rungta
Cryptography and Security
Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation
Md Yassir Mottalib, Md Yousuf, Eklachur Rahman Bhuiyan et al. (+5 more)
With the increasing complexity of cyber assaults in cloud environments, adaptable security solutions are needed that can support real-time detection and autonomous response. In this paper, we propose a reinforcement learning-based dynamic cyber defense framework. We deploy a Deep Q-Network (DQN) to train effective defensive strategies to counteract the evolving cyberattacks. We leverage the CICIDS2017
dataset for model creation and the UNSW-NB15
dataset for external validation, involving preprocessing of data, feature engineering, and adaptive policy learning. We compare the proposed DQN with decision tree, support vector machine, random forest, XGBoost, and multilayer perceptron models. The proposed DQN achieves an accuracy of 99.72%, a precision of 99.68%, a recall of 99.65%, an F1-score of 99.66%, and an ROC-AUC of 0.999, while the false positive rate is 0.31%, the false negative rate is 0.35%, and the detection latency is 15 ms. The framework achieved 99.54% attack mitigation rate, demonstrating strong adaptive and real-time defensive capabilities. These results demonstrate the potential of reinforcement learning as a powerful and scalable approach for autonomous cybersecurity in modern cloud environments.
Read the full abstract ▾
All authors Md Yassir Mottalib, Md Yousuf, Eklachur Rahman Bhuiyan, S M Ahsan Habib, Sonjoy Kumar Dey, Md. Salahuddin Gazi, Molay Kumar Roy, Asaduzzaman Anik
Cryptography and Security
A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models
Vibha Bhavikatti and Mark Stamp
Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability and interpretability of image-based models is largely unexplored within the malware domain. In this research, we employ Gradient-weighted Class Activation Maps (Grad-CAM) as an eXplainable AI (XAI) tool, which we use to analyze eight distinct image types derived from malware samples. We provide quantitative faithfulness and stability metrics for Grad-CAM heatmaps and we compare these heatmaps to High-Resolution Class Activation Mappings (HiResCAM). We also show that Grad-CAM heatmaps can provide useful information for malware classification. Specifically, we show that a Random Forest model trained on features extracted from Grad-CAM images via a MobileNetV2 Convolutional Neural Network (CNN) model achieves a test accuracy of 0.777 across 17 malware families, exceeding a previous
benchmark of 0.750 for this same
dataset. A key finding of this research is that for the malware image transformations considered, accuracy and explanation faithfulness do not coincide, e.g., image transformation techniques that produce the most faithful explanations yield only mid-tier accuracy.
Read the full abstract ▾
Cryptography and Security
Slips: Behavioral Evidence Aggregation for Network Security
Sebastian Garcia, Veronica Valeros, Alya Gomaa et al. (+7 more)
Network intrusion detection systems often analyze individual packets or flows, although malicious behavior may develop across many connections and over time. This may limit their ability to combine isolated detections into a coherent assessment of host behavior. Packet-level features may also be too low-level for complex AI-based detection, requiring additional processing to improve accuracy while maintaining a low false-positive rate. We present Slips, a network intrusion detection system that builds host-centered behavioral profiles and organizes activity into time windows. It uses a modular architecture in which independent modules report evidence rather than generating final alerts directly. Slips then accumulates this evidence into host-level decisions. We evaluate Slips against Suricata on an expert-labeled PCAP
dataset. At the profile-time-window level, Slips achieved 83% higher recall and a 70% higher F1 score than Suricata, while neither system produced false positives. These results indicate that time-window-based evidence accumulation can produce context-aware decisions that better align with expert judgment.
Read the full abstract ▾
All authors Sebastian Garcia, Veronica Valeros, Alya Gomaa, Ondřej Lukáš, Martin Řepa, Lukáš Forst, David Otta, František Střasák, Jan Svoboda, Dita Hollmannová
Cryptography and Security
CCZ-Equivalence and Enumeration of Triprojective APN Functions
Jingchuan Ma, Yanhua Liu and Qiaoyun Huang
We classify all admissible parameters of the G"ologlu–K"olsch triprojective construction of almost perfect nonlinear (APN) functions up to Carlet–Charpin–Zinoviev (CCZ) equivalence. The construction has three coefficients in $K=\mathbb{F}_{2^m}$ and a Frobenius exponent $k$ coprime to $m$. For every $m>1$, we give a necessary-and-sufficient criterion that includes changes of both the coefficients and the exponent. Each parameter choice determines one of the two irreducible cubic
polynomials over $\mathbb{F}_2$. Two functions are equivalent precisely when their exponents and cubics agree, or when the exponents are negatives modulo $m$ and the cubics are reciprocal. When $7\nmid m$, every admissible member is equivalent to a Li–Kaleyski representative: the larger coefficient space adds no CCZ classes. When $7\mid m$, those representatives are inadmissible; we construct replacements and classify the full family. There are exactly $\varphi(m)$ CCZ classes, extending the previously known count for the older subfamilies to all admissible coefficients and all degrees. We also count the parameter triples and compute canonical representatives and explicit equivalence maps in deterministic
polynomial time for every degree, including degrees divisible by seven. The proof combines a reduction to classical semilinear conjugacy with an intrinsic recovery of the scalar field from the polar bilinear map. The reduction from arbitrary EL equivalence is algebraic in every degree, including degrees three and six.
Read the full abstract ▾
Cryptography and Security
ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents
Yutao Mou, Pengfei Yang, Zhe Yin et al. (+6 more)
Large
language model (LLM)
agents integrated with external tools are vulnerable to indirect
prompt injections embedded in environmental states. However, existing studies largely rely on manually implemented or reused environments,
stochastic LLM-based tool simulation, and predefined injection locations, limiting scalable security research across broader domains. To bridge this gap, we propose **ToolHazard**, a scalable
adversarial environment synthesis framework that reduces human engineering and supports expansion with additional seed domains and compute. Through an Environment Simulator, an Attacker
Agent, and a User Simulator, ToolHazard synthesizes executable stateful environments, discovers viable injection points and generates environment-specific payloads, and constructs state-grounded long-horizon tasks. Based on ToolHazard, we build **ToolHazard-Bench** for stress-testing
agents under complex workflows and diverse environmental attacks. Experiments reveal substantial
agent vulnerabilities and show that injection timing and placement affect attack effectiveness. Moreover, ToolHazard-generated
alignment data improves security on both ToolHazard-Bench and AgentDojo while preserving benign task utility.
Read the full abstract ▾
All authors Yutao Mou, Pengfei Yang, Zhe Yin, Zhangchi Xue, Xiaotian Luan, Dingyao Yu, Tong Zhang, Shikun Zhang, Wei Ye
Cryptography and Security
How China-Origin Vision-Language Models Move from Refusal to Reframing in State Alignment
Guang Yang, Fengchen Liu, Alex Wang et al. (+2 more)
State-aligned distortion has been documented in China-origin text-based large
language models (LLMs), but whether, and in what form, it arises in
multimodal systems has not been systematically examined. We construct a balanced
benchmark of 200 core entries spanning ten politically sensitive topics, plus a seven-variant visual-abstraction probe, and run nine
vision-
language models (VLMs), seven China-origin and two non-China, across four elicitation paradigms and two
prompt languages, yielding 21,708 trials. Each response is audited on six dimensions – explicit refusal, information integrity, visual grounding, state-aligned framing,
language consistency, and response length – by two independent frontier LLM judges, validated against three human experts on a 200-trial sample. Measuring each dimension separately lets us decompose
multimodal censorship into individual signals rather than a single refusal-based score; in particular, refusal and framing are measured independently, so a model can stop refusing while still reframing. We find that (i) Chinese-
language prompting roughly triples the odds of state-aligned framing, within every model; (ii) China-origin models reframe more than non-China models (direction robust across judges and human raters; magnitude 1.6–3.2x); (iii) the effect is strongest in text-only political commentary (36.5%) and is gated by recognition of the depicted subject rather than pixel detail, persisting even at silhouette for iconic images; and (iv) across four Qwen generations, state-aligned framing rises while explicit refusal falls: censorship migrates from a visible act (refusal) to an invisible one (fluent reframing). We argue this shift to invisible reframing is fundamentally a problem of human-AI interaction: it removes the very signal users rely on to recognize that information has been withheld.
Read the full abstract ▾
All authors Guang Yang, Fengchen Liu, Alex Wang, Homa Hosseinmardi, Amir Ghasemian
Cryptography and Security
Towards Model-based Run-time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring
Martin Sachenbacher, Martin Leucker, Alexander Weiss et al. (+1 more)
Methods to increase the resilience of systems to cyber-attacks become increasingly important. Control-flow monitoring provides a principled basis to ensure integrity and detect possible anomalies at run-time. Once anomalies have been detected, so-called attack trees can be used to identify possible types of attacks. However, this approach is vulnerable to camouflage, by which attackers try to evade detection (and correct identification) by deliberately manipulating also the system's observed control flow. In this paper, we outline a model-based approach that provides more robust intrusion detection and attack identification through an architecture that combines software- with hardware-based monitoring. In this approach, software-level observation indicates suspicious activities, while hardware-level monitoring checks them separately in more detail, making it much harder for attacks to camouflage themselves and go undetected. We illustrate the approach with an authentication-service example that captures a realistic failure mode: a software-level observer sees an anomalous but apparently harmless control-flow deviation, maps it to a benign root cause in an attack tree, but misses the true intrusion. A second, independent hardware control-flow monitor observes the actual transition sequence and thereby changes the attack-tree diagnosis from a low-severity configuration or maintenance issue to a high-confidence code-injection or control-flow hijack. In this scenario, the proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.
Read the full abstract ▾
All authors Martin Sachenbacher, Martin Leucker, Alexander Weiss, Aliyu Tanko Ali
Cryptography and Security
AmbSentry: Mitigating Sensing Eavesdropping in ISAC Systems by Harnessing Ambient IoT Devices
Yifan Zhang, Yu Bai, Riku Jantti et al. (+2 more)
Integrated sensing and communication (
ISAC) has emerged as a pivotal paradigm for 6G networks, enabling the synergistic convergence of spectral and hardware resources to maximize system efficiency. However, the inherent openness of wireless transmission exposes
ISAC systems to critical security risks, particularly regarding the
privacy of the sensing information. Unauthorized sensing eavesdroppers can extract sensitive target parameters (e.g., range and velocity) by directly estimating open sensing echo channels, rendering traditional data-based protection techniques ineffective. To mitigate this threat, this paper proposes AmbSentry, an
ISAC system that prevents the leakage of sensing information to sensing eavesdroppers by harnessing naturally distributed passive ambient IoT (AIoT) devices. Specifically, these AIoT devices are strategically configured to act as cooperative jammers and ghost targets, introducing controllable interference into the sensing environment. Based on the proposed system, we formulate a joint optimization problem to maximize the integrated sidelobe level at the eavesdropper under quality-of-service (QoS) constraints, thereby degrading sensing eavesdropping performance while maintaining sensing and communication performance for legitimate receivers. Since the problem is non-convex, we further develop an efficient iterative
algorithm to cooperatively design the transmit beamforming at the base station and the reflection modulations of the AIoT devices based on Dinkelbach transformation and block coordinate descent methods. The detailed results also demonstrate that AmbSentry significantly enhances sensing security, allowing the legitimate sensing receiver to achieve a 14-dB SNR advantage in detection probability and a hundred times lower estimation error compared to the eavesdropper.
Read the full abstract ▾
All authors Yifan Zhang, Yu Bai, Riku Jantti, Zhu Han, Christos Masouros
Cryptography and Security · Cross-listed from cs.SE
Instruction Alignment for Binary Code Representation Learning
Huaijin Wang and Shuai Wang
Binary code representation learning is a fundamental problem in software security and reverse engineering. Existing methods mainly learn function-level
embeddings that capture coarse-grained semantic relationships between binary functions, but they largely ignore fine-grained instruction-level correspondences. This limitation misses valuable supervision signals available from compiler debug information, which can support the learning of more accurate and interpretable binary code representations. We propose to leverage instruction
alignment knowledge to further improve binary code representation learning. Our preliminary study reveals that models finetuned for function-level binary code similarity exhibit substantially better instruction
alignment than their pre-trained model, suggesting a strong correlation between instruction
alignment and function-level
embedding quality. Motivated by this observation, we design a training approach that explicitly incorporates instruction
alignment as an auxiliary training objective. Our experiments show that instruction
alignment training improves
retrieval accuracy and provides more discriminative signal for the model's similarity judgments.
Read the full abstract ▾
Cryptography and Security
Fingerprinting Text-to-Image Diffusion Models via Collapsed Generation
Yuanmin Huang, Chen Chen, Geng Hong et al. (+5 more)
Proprietary text-to-image
diffusion models are increasingly distributed as hosted services and downloadable checkpoints, making their intellectual property (IP) protection an increasingly critical concern when model leakage, copying, or unauthorized fine-tuning is disputed. In this work, we present a non-invasive model fingerprinting framework based on collapsed generation, a phenomenon where certain input conditions produce highly consistent images across multiple
stochastic seeds. We show that collapsed generation is an intrinsic, model-dependent property of the learned generation process. These collapse-prone conditions therefore expose model-specific behavioral signatures, enabling reliable ownership verification without
embedding invasive watermarks. After preparing conditions on the source model, the framework verifies a suspect model under two access settings: (1) white-box pipeline access, where optimized continuous
embeddings can be injected into the generation process, and (2) black-box API-only access, where natural
language prompts are queried through the service interface. In both cases, ownership evidence is measured by whether the suspect model reproduces the source model's collapse behavior across
stochastic samplings. Extensive experiments across UNet- and
transformer-based
diffusion models show that collapsed generation fingerprints can distinguish different source models with low confusion. These fingerprints remain verifiable in fine-tuned derivatives and under common and adaptive model- or query-level obfuscations, while requiring only a modest verification query budget. Together, these results establish collapsed generation as a reliable intrinsic evidence source for non-invasive
diffusion model ownership verification.
Read the full abstract ▾
All authors Yuanmin Huang, Chen Chen, Geng Hong, Xiaoyu You, Hui Xue, Zhenxing Qian, Mi Zhang, Min Yang
Cryptography and Security
Plaintext Recovery Against Post-Filtering Access Control
Zachary Espiritu and David Cash
Fine-grained access control (FGAC) mechanisms such as row-level security (RLS) and document-level security (DLS) are widely deployed in databases to restrict access to data stored in physical indexing structures shared by multiple users (e.g., in multi-tenant databases, or in the implementation of least-privilege within an organization). FGAC implementations often use post-filtering where untrusted queries run over all data and private results are redacted afterwards. Prior work shows this approach can lead to side-channels that enable attackers to test if a chosen value exists in unseen data. While damaging, prior attacks do not enable the efficient recovery of rich, high-
entropy data like full records or text documents. We show these side-channels are more damaging than previously thought. Using rich query interfaces (e.g., range, prefix, and conjunctive predicates), we amplify existence leakage into reconstruction attacks. We do this in two settings: - PostgreSQL (RLS timing). We exploit a timing side-channel and expressive SQL queries (e.g., ranges, conjunctions) to enumerate unknown attribute values and, in turn, full records via binary search over large domains. - Elasticsearch/OpenSearch (DLS scoring). We exploit scoring and prefix-expansion side-channels to recover indexed terms from documents. In some cases, we can extract $n$-grams in the corpus to recover approximate text. Our results show that FGAC side-channels must be evaluated in the presence of rich predicates, which can turn membership tests into scalable reconstruction of high-
entropy records.
Read the full abstract ▾
Cryptography and Security
Towards Scalable Fuzzy PSI via Efficient Fuzzy Matching
Meng Hao, Xinpeng Yang, Hanxiao Chen et al. (+5 more)
In this paper, we present scalable fuzzy PSI protocols for general $L_{p \in [1, \infty]}$ distance, supporting both low- and high-dimensional sets. The core technique is two efficient fuzzy matching protocols. The first is built from a role-reversed oblivious PRF (OPRF) and realizes $O(d\log \delta)$ overhead, compared to $O((\log \delta)^d)$ in previous works. The second leverages customized oblivious transfer (OT) with $O(d\ell)$ overhead, where $\ell$ is the bit length of inputs, which is particularly suitable for short inputs. With these new techniques, we further propose a new dual-layer hashing framework for fuzzy PSI over low-dimensional sets, instantiated with our OT-based fuzzy matching and enhanced with a domain reduction optimization. The protocols achieve an overhead linear with $n, m, \log \delta, 2^d$, without the $O((\log \delta)^d)$ or $O(\delta)$ factors present in prior works. {For high-dimensional sets, we construct fuzzy PSI protocols based on our OPRF- and OT-based fuzzy matching, which achieve an asymptotic overhead linear with $n, m, d$, and $\log \delta$ but rely on the strong globally disjoint assumption.} Extensive evaluations demonstrate that our protocols achieve up to a $145\times$ speedup in running time and a $20\times$ reduction in communication cost compared to van Baarsen and Pu~(ASIACRYPT'25), and achieve up to a $25\times$ speedup in running time and up to a $17\times$ reduction in communication cost compared to Piske et al.~(CCS'25).
Read the full abstract ▾
All authors Meng Hao, Xinpeng Yang, Hanxiao Chen, Tianwei Zhang, Haiyang Xue, Guomin Yang, Hongwei Li, Robert H. Deng