Cryptography and Security
COMA: A Compositional Misleading Attack Class on Security-RAG, and a Causal Counterfactual Defense
Chinmay Gondhalekar and Urjitkumar Patel
Every document a security copilot retrieves can be true, instruction-free, and non-contradictory — and the copilot can still be driven to assess a critical, exploitable vulnerability correctly and then recommend a remediation that leaves it open. We study this failure in
retrieval-augmented generation (RAG) backing analyst-facing copilots in Security Operations Centers, and identify a class of attacks, \emph{\compmis{}} (COMA), in which every
adversarial document is factually correct, instruction-free, non-contradictory, and distributionally benign — yet the answer is misled by their composition. We realize \compmis{} through action-corruption, which steers a correctly-diagnosed vulnerability toward an inferior remediation, and verdict-flip, which destabilizes the exploitability verdict via an undecidable reachability chain. Action-corruption bites all five tested models — including frontier
reasoning models — on every run, on two synthetic domains and a real CVE (CVE-2021-33813); verdict-flip bites stochastically, decreasing with model capability but never vanishing. A single principle governs both: the attack succeeds when the disambiguating fact must be inferred rather than read. We propose \ccd{} (Causal Counterfactual Defense), an audit that measures the leave-one-out causal influence of each retrieved document and flags answers whose influence concentrates on low-trust documents. \ccd{} localizes the attack to attacker-controlled documents with no false positives on four benign multi-document controls; an adaptive influence-spreading adversary is caught by an aggregate variant. We release attack seeds and a \ccd{} reference implementation.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.IT
Tail exponents of conditional guesswork via the method of types
Adway Girish, Andreina Patrizia Motter and Emre Telatar
We study the problem of guessing a realization of an i.i.d. random sequence given element-wise correlated side-information. We use type-counting to provide estimates of the tail probabilities of the number of guesses for the case without side-information, which was shown earlier through large-deviation techniques. We then extend the same counting argument to the conditional setting, obtaining new explicit expressions for the corresponding guesswork exponents as divergences involving conditional tilted distributions. Finally, we provide an application of these exponents to brute-force password guessing with side-information.
Read the full abstract ▾
Cryptography and Security
The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges
Maosen Zhang, Jianshuo Dong, Boting Lu et al. (+5 more)
LLMs increasingly rely on external contexts, such as pre-defined system
prompts or retrieved documents, to improve generation quality. However, processing these contexts alongside user queries creates an attack surface:
adversarial inputs can induce models to disclose them. Prior probing studies suggest that leakage-related signals emerge in hidden states, yet the need to extract these states poses additional deployment challenges. In this paper, we explore whether this internal signal leaves a more accessible “tell” before decoding. We propose LeakGauge, which probes this response by appending a suffix that gauges leakage behavior and mapping its prefill
token probabilities to an attack-risk score. While a direct gauge uses the initial
tokens of confidential content, we find that a content-agnostic one that verbalizes leakage behavior yields more robust signals. Across 11 LLMs, including GLM-5.2 (753B) and Kimi-K3 (2.8T), LeakGauge reaches an AUROC range of 0.944–0.996 on unseen attacks. The signal remains stable when the content changes
language or the attack shifts from verbatim to semantic disclosure. By activation-steering interventions, we further show that the risk score is sensitive to an internal leakage-related direction, relating the observable signal to the model's internal representation. In addition, LeakGauge enables an input detector with fewer than 0.5K extra parameters and added latency of 10.34 ms. Code: \href{https://github.com/yeasen-z/LeakGauge}.
Read the full abstract ▾
All authors Maosen Zhang, Jianshuo Dong, Boting Lu, Wenyue Li, Xiaoping Zhang, Tianwei Zhang, Jie Zhang, Han Qiu
Cryptography and Security
Diff-DDoS: Realistic Cyber-Physical Attack Synthesis and Robust Detection for 5G-Enabled CPS Using Tabular Diffusion Models
Bilal Hussain, Xiao Tang, Qinghe Du et al. (+3 more)
Deep learning-based DDoS detectors for 5G-enabled cyber-physical systems face scarce labeled attack data and unrealistic synthetic substitutes, which limit robustness against adaptive adversaries. Detectors trained on hand-crafted attacks with fixed scaling multipliers degrade catastrophically (F1-score drops of about 47 percent to 100 percent, depending on scenario) when confronted with realistic, distribution-preserving samples. We propose Diff-DDoS, a three-phase framework for realistic attack synthesis and robust detection using tabular
diffusion models. Phase 1 trains a baseline CNN
cell-level detector on spatiotemporal grids from call detail records (CDRs). Phase 2 trains a tabular denoising
diffusion probabilistic model (TabDDPM) on normal CDR aggregates to generate realistic attacks and expose detector vulnerabilities. Phase 3 introduces
adversarial diffusion training (ADT), using inverse classifier guidance to generate hard yet distribution-preserving samples until the detector converges. On a Milano CDR
dataset across SMS-flooding, silent-call, Internet-signaling, and blended scenarios, ResNet50 with ADT recovers F1-scores of 79.62 percent (silent-call), 100 percent (Internet), and 92.79 percent (blended). After validation-based threshold calibration, ADT reaches 100 percent SMS F1 versus 47.3 percent for CTGAN, and matches the strongest gradient-based
adversarial-training baseline on silent-call. These results support tabular
diffusion models for stress-testing and hardening intrusion detectors in data-scarce 5G cyber-physical deployments.
Read the full abstract ▾
All authors Bilal Hussain, Xiao Tang, Qinghe Du, Tan Li, Muhammad Azhar, Danista Khan
Cryptography and Security
Efficient Fuzzy PSI under One-Sided Assumptions
Xinpeng Yang, Meng Hao, Yanxue Jia et al. (+3 more)
Fuzzy private set intersection (PSI) enables two parties to identify approximately matching elements between their input sets, where two elements are considered a match if their distance is at most a threshold $\delta$ under a given metric. Although substantial progress has been made, existing constructions for general Minkowski distances either rely on strong two-sided
geometric separation assumptions or incur substantial overhead under one-sided assumptions. In this work, we present the first concretely efficient fuzzy PSI protocols for general $L_{p\in[1,\infty]}$ distances under one-sided assumptions, relying solely on lightweight symmetric-key primitives. Our constructions support both sender-sided and receiver-sided settings. We further study sparser input distributions and present more efficient protocols tailored to this case. To reduce the overhead scaling with $\delta$, we non-trivially incorporate prefix trie techniques into our protocols, achieving $O(\log\delta)$ complexity for general $L_{p\in[1,\infty]}$ distances for the first time, improving upon $O((\log\delta)^d)$ or $O(\delta)$ complexities of prior works. Extensive experiments, across a wide range of parameter settings, show that our protocols significantly outperform prior works under the same assumptions. Specifically, against van Baarsen and Pu (EUROCRYPT'24), our protocols achieve up to $248\times$ faster computation and up to $20\times$ lower communication. Against Dang et al. (CCS'25), we achieve up to $568\times$ speedup and up to $63\times$ communication reduction. Against Bui et al. (ASIACRYPT'25), we achieve up to $4978\times$ faster computation and up to $282\times$ lower communication.
Read the full abstract ▾
All authors Xinpeng Yang, Meng Hao, Yanxue Jia, Chenkai Weng, Yonggang Wen, Tianwei Zhang
Cryptography and Security · Cross-listed from cs.CY
Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums Strategies, Barriers, and Future Directions
Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake et al. (+6 more)
Australian women, gender-diverse individuals, and culturally and linguistically diverse (CALD) communities are often more susceptible to phishing and other forms of cybercrimes due to factors such as
language barriers, limited access to cybersecurity education, and social isolation. These communities encounter substantial obstacles both entering and progressing in the cybersecurity field. In Australia, the Higher Education sector still leans heavily on a largely uniform cybersecurity curriculum, focusing heavily on technical proficiency, overlooking the vital impact of intersectionality and user-centered thinking for boosting student engagement and learning. Without gender inclusivity and proper consideration of intersectionality forms such as CALD, the workforce is deprived of the varied perspectives necessary to tackle today's intricate cybersecurity issues. In this study, we conducted semi-structured interviews with 15 experienced academics teaching and coordinating cyber security programs from a diverse range of Australian universities, covering all states, to explore their perspectives on: i) current strategies for addressing the women, gender-diverse and CALD perspective in cyber security education in the Australian HE sector; ii) barriers to incorporate women, gender-diverse and CALD perspective in cybersecurity curriculums in higher education; iii) future work and support that is needed. Our research highlights a lack of systematic methods for integrating intersectional perspectives into cybersecurity curriculums. In particular, we identified four key barriers and four areas where support and future efforts are needed to address this issue. Our findings offer vital insights that can substantially guide curriculum development in cybersecurity education.
Read the full abstract ▾
All authors Nalin A. G. Arachchilage, Asangi Jayatilaka, Senuri Wijenayake, David Herbert, Kaie Maennel, Nicole Herbert, Claudia Szabo, Gabrielle Murray, Gary Thomas
Cryptography and Security
Achievement Unlocked: Let's Get Hacked! An Empirical Study of Cybercrime in the Video Gaming Ecosystem
Janine Schneider, Jan Kallenborn, Tim Hoffmann et al. (+3 more)
The ubiquity of the
video game industry and its large user base have transformed
video games into complex social and economic ecosystems. Unfortunately, this growing popularity also attracts cybercriminals who deliberately exploit game-specific mechanisms to target players. Despite this growing threat, cybercrime in the gaming ecosystem has received little systematic
attention in prior research. In this work, we present an empirical study of cybercrime affecting
video game players, combining qualitative and observational analyses to characterize gaming-related attacks, identify common attack vectors and motivations, and examine player responses. Our study is based on an online survey with 57 international participants, semi-structured interviews with two confirmed victims of gaming-related cybercrime, and an analysis of 2,574 publicly available posts reporting cybercrime incidents across multiple online gaming platforms. Our findings indicate that the theft of digital items is a prevalent motivation for attacks. We further observe that gaming-related features and services, such as item trading, team voting, and tournaments, create incentives for players to engage in risky interactions. In addition, our results highlight the targeted exploitation of weaknesses in customer support processes and reveal that certain security mechanisms provide only a false sense of protection.
Read the full abstract ▾
All authors Janine Schneider, Jan Kallenborn, Tim Hoffmann, Maximilian Eichhorn, Thorsten Holz, Bhupendra Acharya
Cryptography and Security · Cross-listed from cs.SE
SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients
Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu et al. (+1 more)
Ethereum's consensus safety relies on independent consensus client implementations agreeing on every state transition. When they diverge due to implementation errors, the network can fork, finality can stall, and severe attacks are possible. To prevent such consensus divergences, Ethereum provides a Python reference implementation (consensus-spec), which acts as a specification, and a hand-crafted official test suite (spectests). However, as an executable implementation, Ethereum's specification defines validity implicitly through runtime behavior. As a result, it lacks a systematic way to ensure that all validity conditions are thoroughly evaluated. We present SpecTrum, a framework that addresses this problem in three stages. First, we introduce Consensus-SpecTec, a mechanized specification of the Ethereum consensus
algorithm, which makes validity conditions explicit as if-premises. Second, we define premise coverage, a metric that measures which if-premises are evaluated to true and false across spectests. Third, we develop a specification-based test generator that extracts constraints on premises not evaluated to false by spectests and generates inputs to evaluate them. Applying SpecTrum to five major Ethereum consensus clients, we identify 27 cross-client divergence cases, 22 of which cannot be found without the premises inserted in our mechanization. All 27 cases reproduce across fork versions, and extending the mechanized specification to a new fork takes modest effort proportional to the specification difference.
Read the full abstract ▾
All authors Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu, Sungjae Hwang
Cryptography and Security
BullsEye: Directed Firmware Fuzzing
Lorenzo Ralli and Emilio Coppa
The widespread adoption of Internet of Things (IoT) devices has expanded the digital attack surface, making firmware analysis critical for modern software security. A key security concern stems from the frequent reuse of third-party software components, a practice that often introduces known vulnerabilities into firmware images. Whether a given image actually exposes such a flaw is an open question, and public proof-of concept exploits make answering it urgent. Directed Greybox Fuzzing (DGF), a technique that enables targeted exploration of specific binary locations, offers a promising solution for detecting such vulnerabilities. However, DGF has reached firmware only at function granularity, too coarse to aim at the vulnerable block itself. This article presents BULLSEYE, the first DGF framework to schedule closed-source Linux-based firmware fuzzing by basic-block-level distance to user-specified targets. Our methodology combines static and dynamic analysis to enable DGF in the constrained firmware domain, focusing on vulnerabilities in reused third-party components. We introduce novel DGF heuristics that address limitations of traditional approaches. We compare BULLSEYE against four greybox-fuzzing baselines sharing its execution back-end, including reimplementations of AFLGO and WINDRANGER, and against GREENHOUSE, a state-of-the-art firmware re-hosting framework. On 40 vulnerability sites across 32 firmware images, BULLSEYE reproduces every target within budget, against 35 for the strongest of the four baselines, and reduces Time-to-Exposure by a
geometric mean of 9.5x to 72.5x over them; against GREENHOUSE, on the 18 targets its pipeline supports, BULLSEYE is faster by a
geometric mean of 9.8x.
Read the full abstract ▾
Cryptography and Security
MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoning
Xukun Luan, Jinyan Liu, Yuhui Gong et al. (+4 more)
Vision-
Language models (VLMs) achieve outstanding performance largely due to the amount of training data available on the internet. At the same time, data holders (e.g., artists) urgently need to determine whether their data has been used for model training without authorization, which concerns both intellectual property rights and personal
privacy. Data auditing, particularly through membership inference (MI), has attracted
attention as a direct tool. This work proposes MemCatalyst, a set of data poisoning tools, aiming to amplify the data auditing performance on VLMs. MemCatalyst employs two strategies: Poisoning Text (PT) and Poisoning Image (PI). MemCatalyst forces VLMs to over-learn specific inconsistencies between image features and textual semantics during training, thereby increasing their susceptibility to membership information auditing. Crucially, the transferability of poisoned samples across different VLM architectures is demonstrated to be effective in the black-box setting. Extensive evaluations using five state-of-the-art data audits on two prominent VLMs demonstrate that MemCatalyst markedly enhances MI AUC scores with a minimal budget of poisoned samples, while maintaining a negligible impact on model performance.
Read the full abstract ▾
All authors Xukun Luan, Jinyan Liu, Yuhui Gong, Yuanguo Bi, Bing Hu, Xuesong Li, Di Wang
Cryptography and Security · Cross-listed from cs.SE
Benchmarking Automated Security Patch Backporting: How Far Are We?
Jincheng Yang, Yulong Fu, Chengwei Liu et al. (+5 more)
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective
datasets. However, these evaluations are often confined to homogeneous environments, such as one repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting
Benchmark, a curated
dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this
benchmark, we evaluate five tools spanning program analysis, LLM prompting, and LLM
agents under aligned settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication
Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based
benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases.
Read the full abstract ▾
All authors Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu, Hui Li
Cryptography and Security
MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps
Sujin Chen, Lijun Li, Tianyi Du et al. (+1 more)
LLM-powered GUI
agents that autonomously operate smartphones are rapidly transitioning from research prototypes to early real-world deployment. However, because these
agents routinely process untrusted environmental content, they are highly vulnerable to environmental injection attacks, which include indirect
prompt injections and
adversarial instructions. Such attacks can manipulate the behavior of
agents without user awareness through diverse channels encountered in everyday mobile use. Despite these risks, existing
benchmarks often fail to capture everyday user scenarios, lacking a systematic evaluation of GUI
agents under environmental injection attacks on mobile devices. To address this gap, we introduce MobileWorldSafety, a
benchmark of 142 risk tasks built on real Android applications. For each task, we define a programmatically verifiable risk indicator over the final system state and evaluate outcomes with a two-stage pipeline: rule-based verification handles unambiguous cases, while an LLM judge adjudicates ambiguous ones. This distinguishes safety failures from capability failures and enables objective and reproducible assessment. Evaluations on six
agents, including both general
agents and specialized GUI
agents, demonstrate that all
agents remain highly vulnerable, with attack success rates ranging from 40.4% to 66.9%. These findings indicate that current
agents often fail to maintain safety
alignment when
adversarial content is presented as ordinary mobile context. MobileWorldSafety provides a foundation for quantifying these vulnerabilities and advancing research on robust mobile GUI
agents.
Read the full abstract ▾
All authors Sujin Chen, Lijun Li, Tianyi Du, Jing Shao
Cryptography and Security
An Emulation Anchored Digital Twin Testbed for Cyberattack and Defense Analysis in Hospital IT OT Environments
Prashant Rawat, Ravi Kumar Bairagi, Arunima et al. (+1 more)
Modern hospitals increasingly rely on integrated Information Technology (IT) and Operational Technology (OT) infrastructures to support critical healthcare services. However, this convergence expands the cybersecurity attack surface and makes safe validation of defensive mechanisms difficult on live systems. Existing testbeds often focus on isolated IT or OT environments and do not capture realistic cross-domain healthcare interactions. This work presents a hospital IT and OT cybersecurity testbed coupled with a digital twin for monitoring, experimentation, and validation of countermeasures. The testbed emulates a central server, Electronic Health Record (EHR) systems, SCADA-based infrastructure, and segmented IT, OT, and DMZ networks. It supports controlled cyberattack execution, software-patch evaluation, and training of RL-based defense
agents. The testbed is further extended to a digital twin that models the real-time state of the environment using log and network statistics and enables bidirectional interaction through command execution and container lifecycle orchestration. Modbus/TCP and FHIR/HL7 support realistic communication across healthcare and industrial components. Experimental evaluation shows low computation overhead, with average normalized CPU utilization below 0.4 % per container and most lightweight services operating below 0.01%. OpenPLC Modbus TCP operations achieve a median round-trip latency of 0.901 ms. The testbed also captures a multi-stage SSH-based attack propagating from the DMZ to the IT and PLC networks. The framework provides a foundation for extending the emulated environment toward a hardware-enabled hospital digital twin.
Read the full abstract ▾
All authors Prashant Rawat, Ravi Kumar Bairagi, Arunima, Geeta Yadav
Cryptography and Security · Cross-listed from quant-ph
Unclonable encryption from BB84 states: a simultaneous Goldreich-Levin reduction
Andrea Coladangelo, Qipeng Liu and Ziyi Xie
Goldreich-Levin reductions are ubiquitous in cryptography: they convert an
algorithm capable of guessing $\langle r, m \rangle$ (mod $2$) for a hidden string $m$ and a random challenge $r$, to one that is capable of extracting the entirety of $m$. Here, we describe a "simultaneous" Goldreich-Levin reduction for two entangled parties who are capable of guessing $\langle r, m \rangle$ given uniformly random identical challenges $r$. This allows to upgrade any unclonable encryption scheme satisfying "search" security to one satisfying the gold standard of unclonable "indistinguishability". As a corollary, we show that the simplest candidate unclonable encryption scheme from BB84 states satisfies unclonable indistinguishability. This result was discovered by GPT-5.6 Ultra after a few interactions. Our
prompts included recent results on unclonable encryption by Ananth and Sahai, and Ragavan.
Read the full abstract ▾
Cryptography and Security · Cross-listed from quant-ph
Towards the Impossibility of Imperfectly Complete Key Agreement in the QROM
Fuyuki Kitagawa, Ryo Nishimaki, Agi Villanyi et al. (+1 more)
We make progress towards the impossibility of
quantum-computation, classical-communication (QCCC) key agreement by giving the first unconditional
polynomial-query attacks that tolerate imperfect completeness in the following settings. First, we give a
quantum attack on protocols with arbitrarily many rounds in which both parties' oracle queries and communication are classical before the final round, while local computation may be
quantum throughout, and the final round may involve
quantum oracle queries and one
quantum message. Second, we give a classical attack on constant-round QCCC protocols in which Alice has classical oracle access and Bob may make
quantum queries throughout. In both settings, the attacker is computationally unbounded and makes $poly(\lambda)$ queries to recover the key with nonnegligible probability whenever each party's total honest query bound is at most $poly(\lambda)$ and the valid agreement probability is inverse-
polynomial. As consequences, we rule out query-bounded IND-CPA security for
quantum public-key encryption with classical public and secret keys and classical messages of polynomially bounded length in the QROM in either of two settings: (i) key generation has classical oracle access, while encryption, decryption, and the ciphertext may be
quantum; or (ii) encryption has classical oracle access and ciphertexts are classical, while key generation and decryption may have
quantum oracle access. Both results assume negligible correctness error and
polynomial honest query complexity. Combining the constant-round attack with the constructions of Bartusek and Khurana (CRYPTO 2025), we also rule out constant-round oblivious state preparation with
polynomial honest query complexity and negligible correctness error in the QROM against computationally unbounded
quantum receivers making polynomially many oracle queries.
Read the full abstract ▾
All authors Fuyuki Kitagawa, Ryo Nishimaki, Agi Villanyi, Takashi Yamakawa
Cryptography and Security
HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety
Yajing Bai, Jinhao Duan, Jie Peng et al. (+4 more)
Large
language models are increasingly deployed through
agent harnesses that manage tools, extensions, persistent state, permissions, and external actions. Existing safety
benchmarks mainly target individual attack mechanisms or a limited subset of operational settings, making it difficult to compare how safety failures emerge across different harness responsibilities. We present HarnessRisk, a lifecycle oriented
benchmark that organizes
agent harness safety into six operational phases including Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, and Incident Recovery. HarnessRisk contains 128 sandboxed cases, each pairing a benign user objective with an
adversarial instruction embedded in an untrusted workflow artifact. We evaluate each trajectory using Utility, Attack Success Rate, Persistence, and Detection. Across three harnesses, six
language models, and 14 model and harness configurations, attack success ranges from 12.6% to 80.9%, while Utility remains between 75.0% and 97.6%. Harness Configuration is the most vulnerable phase across all three harnesses, showing that attacks can succeed by altering security sensitive parameters within otherwise authorized workflows. We also find that explicit risk recognition does not reliably lead to safe action, as some configurations detect risks in more than 90% of runs while retaining substantial attack success. These results highlight the need to evaluate
agent safety across multiple harness responsibilities and at the level of the deployed model and harness configuration.
Read the full abstract ▾
All authors Yajing Bai, Jinhao Duan, Jie Peng, Xianfeng Wu, Sijia Liu, Song Wang, Tianlong Chen
Cryptography and Security · Cross-listed from cs.SD
The Last Mile of Deepfake Speech Detection: An Industry-Academia Experience Report
Anton Firc, Kamil Malinka, Vojtěch Staněk et al. (+2 more)
Synthetic
speech detection
benchmarks now report sub-1% error rates on some in-domain evaluations, yet performance degrades under unseen attacks, channel mismatch, and distribution shift. Based on a three-year effort with Phonexia, a commercial speaker-recognition vendor, we report barriers encountered while building and deploying a detector. Many public
benchmarks are not licensed for commercial model development. Real inputs are not four-second clean clips but long, codec-degraded, sometimes partially synthetic recordings. And when a calibrated system returns a log-likelihood ratio of 2.5, no one can tell the customer what it means for their decision. Rather than proposing a new model, we connect these barriers to concrete research and coordination proposals: shared standards for commercially usable
datasets, realistic deployment
benchmarks, and scores that non-experts can act on. These observations come from one project and should be tested in other settings.
Read the full abstract ▾
All authors Anton Firc, Kamil Malinka, Vojtěch Staněk, Miroslav Hlaváček, Marek Bartoň
Cryptography and Security
Reflex-Guard: A Low-Latency Guardrail for LLM Prompt Safety Using Dense Semantic Embeddings
Istiaque Ahmed, Afia Anjum Borsha, Ranat Das Prangon et al. (+2 more)
Large
Language Models (LLMs) in real-world applications often face the risks of specially crafted
prompts designed to bypass the safety controls. Existing guardrail methods, such as LLM-as-a-judge and cloud-based safety APIs are able to detect unsafe content. However, they often add a delay of about 250-900 ms to each request. This delay is too high for real-time applications, when the system usually needs to respond in less than 100 ms. Furthermore, routing user
prompts through external moderation endpoints raises significant data
privacy concerns. This paper introduces Reflex-Guard, a lightweight guardrail that runs locally. It uses jailbreak-aware preprocessing, compact sentence-
transformer embeddings, and seven fast binary classifiers. Together, these components enable high-accuracy
prompt safety filtering with much lower latency than existing solutions. Through systematic evaluation on a strategically balanced
dataset of 30,568 samples drawn from five complementary sources, we demonstrate that Reflex-Guard achieves 95.9% recall on harmful
prompts at 37.6 ms end-to-end latency. It is faster than existing baselines, including Llama Guard 2 at 255 ms and SafeDecoding at 723 ms. It can detect 100% of GCG suffix attacks and Base64-encoded
prompts using the default threshold. However, DrAttack structured
prompts required lowering the threshold to 0.03 for optimal detection, as they produced a distinct probability distribution. Reflex-Guard achieves Reflex Efficiency Score (RES) scores up to 16.79, significantly outperforming Llama Guard 2 (11.90) and SafeDecoding (9.80). This analysis offers practical deployment advice and shows that different attack types occupy distinct regions in the
embedding probability space.
Read the full abstract ▾
All authors Istiaque Ahmed, Afia Anjum Borsha, Ranat Das Prangon, Abu-fuad Ahmad, Thi Hong Tran
Cryptography and Security
Software Defined Networks Key Relay for Large-Scale Quantum Key Distribution Networks
Stephan Laschet, Gergely Lendvay, Thomas Lorünser et al. (+3 more)
This work addresses the orchestration of large-scale
Quantum Key Distribution Networks (QKDNs) using Software Defined Networking (SDN). Building on ETSI and ITU specifications, common best practices and architectures are outlined. The main task of the SDN Controller is to aggregate technical key performance indicators (KPI) from the network and, based on these, select the optimal path. Multiple path selection
algorithms, based on Dijkstra or a maximum-minimum capacity
algorithm, with built-in load balancing are presented. The
algorithms were tested in simulations and their performances, and tradeoffs, are discussed. Additional critical aspects related to SDN controlled QKDNs are discussed, such as query batching, multi-path selection and group key capabilities. An oblivious multi-party protocol is proposed for relay path selection in a multi-domain scenario, so providers don't have to disclose sensitive information about their QKDN. These contributions aim to enhance scalability, resilience and interoperability in
quantum-secure network infrastructures.
Read the full abstract ▾
All authors Stephan Laschet, Gergely Lendvay, Thomas Lorünser, Paul James, Luca Torresetti, Alessandro Colombo
Cryptography and Security
TENET: Telegram Mini App (in)security
Andrea Ciccotelli, Federico Zappone and Roberto Di Pietro
Telegram, with over 450 million daily active users, has introduced Mini Apps—web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials—such as session
tokens and wallet mnemonic phrases—in plaintext on client devices, exposing users to unauthorized access, impersonation, and financial exploitation. While insecure client-side storage is a known risk in web applications, the Telegram Mini App ecosystem presents a uniquely dangerous combination of factors absent from prior work: no platform-level security review, no storage access restrictions, a financially motivated user base handling live cryptocurrency assets, and a WebView environment that offers weaker protections than standalone browsers. To investigate this threat, we present TENET, a purpose-built auditing tool whose design decisions—pattern selection,
entropy thresholds, and charset validation—are grounded in the structural properties of the secrets targeted and empirically validated against a ground-truth
dataset. We screened 61 Mini Apps using a stratified, popularity-weighted sampling strategy based on popularity. Of the 37 applications that met our processing criteria and were analyzed, 30 exhibited security flaws, which we classify into three severity tiers: plaintext storage, recoverable encryption, and replayable
tokens. Notably, even Telegram's official Wallet exhibits a severe vulnerability that may lead to full account compromise. Following our responsible disclosure, Telegram implemented two new secure-storage APIs, and our post-remediation verification confirmed that its official Wallet no longer exposes the recovery mnemonic in plaintext. Finally, we propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
Read the full abstract ▾
Cryptography and Security
SoK: Cross-Chain Transaction Identification and Matching
Hang Zheng, Qishuang Fu, Joseph Liu et al. (+3 more)
Cross-chain bridges, instant cryptocurrency exchanges, and centralized cross-ledger platforms move assets across an increasingly multi-chain ecosystem. However, these systems have repeatedly become targets of high-value attacks and channels for cross-chain money laundering. Cross-chain transactions are substantially harder to analyze than single-chain transactions: no single ledger records an entire cross-chain transfer, its evidence is scattered across the source chain, the destination chain, and off-chain systems, and the availability and reliability of that evidence vary widely across systems. In this paper, we present a systematization of knowledge (SoK) on cross-chain transaction identification and matching. First, we classify deposit and withdrawal identification methods into four approaches and transaction matching methods into three mechanisms: deterministic identifier matching, field-constraint heuristics, and model-assisted matching. We find that their applicability and reported performance are shaped mainly by the evidence the underlying system exposes, and we further examine how matched pairs support downstream attack detection and fund tracing. Second, we assess the availability of existing
datasets and artifacts, finding that fewer than half remain obtainable, and distill three artifact failure modes. Finally, we outline four open challenges toward auditable, reproducible, and actionable cross-chain analysis.
Read the full abstract ▾
All authors Hang Zheng, Qishuang Fu, Joseph Liu, Qin Wang, Weiqing Wang, Tsz Hon Yuen
Cryptography and Security
CryptDough: A Unified Analytics Engine for Secure Multiparty Computation
Muhammad Faisal, Alessandra Lanz, Sam Buxbaum et al. (+4 more)
We present CryptDough, a unified analytics engine for secure multiparty computation (MPC). CryptDough enables multiple distrusting parties to jointly execute a data analysis pipeline on their private inputs and learn nothing beyond the result (e.g., aggregate statistics). Unlike existing MPC solutions that support a single threat model or workload type, CryptDough provides built-in support for cross-domain analytics (relational, time series, ML inference) under various threat models, all within the same system runtime. CryptDough contributes (i) a hierarchical system design that facilitates modularity and extensibility through progressive lowering of abstractions, and (ii) the concept of virtual vectors that enable users to write single-threaded code across all layers of the software stack, while pushing the complexity of communication, parallelization, and
memory management down to the execution engine. We show that CryptDough generalizes the functionality of state-of-the-art MPC systems and remains competitive on the analytics they support, often outperforming them by more than $2\times$.
Read the full abstract ▾
All authors Muhammad Faisal, Alessandra Lanz, Sam Buxbaum, Adam Godel, Vasiliki Kalavri, Mayank Varia, John Liagouris
Cryptography and Security
Cross-Domain Joint DDoS Detection in Multi-Controller SDN via Confidence-Based Entropy Fusion
Zhaoyang Zhang, Shen Wang and Xiaofeng Tao
In multi-controller Software-Defined Networking (SDN), Distributed Denial-of-Service (DDoS) attacks exhibit a "dispersed source, concentrated target" pattern across domains, i.e., attack traffic originates from multiple edge-controller domains but converges on a victim in a single aggregation controller domain. While
entropy-based DDoS detectors are effective in single-controller settings, their direct application in multi-controller SDN reveals a previously overlooked anomaly. Through systematic experiments, we identify an aggregation bias: during the post-attack transition phase, the aggregation controller continues to generate excessive false positives, while edge controllers have already returned to normal. We attribute this phenomenon to the coupled effects of OpenFlow statistics lag and unconstrained dynamic-threshold drift. To address this issue, we propose a cross-domain confidence-fusion framework that leverages lightweight edge-side messages to calibrate aggregation-controller decisions without sharing raw traffic data. The framework is non-intrusive, communication-efficient, and incrementally deployable. Experiments on a three-controller linear Mininet testbed with 24 hosts over 10 runs show that the method preserves edge-controller performance while reducing the aggregation false positive rate from 8.87% to 1.96% and increasing the F1 score from 89.04% to 96.89%.
Read the full abstract ▾
Cryptography and Security
KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation
Bowen Sun, Yixi Cai, Xiaogeng Liu et al. (+3 more)
Large
language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials. Providers scope
prompt caches to upstream principals and namespaces, so relay customers mapped to one cache identity can observe each other's cache state. Prior work showed cache sharing at selected endpoints but did not identify which credential, pool, adapter, or nested hop controls the finalidentity. We present KeyPooling, a measurement method that traces customer identity through cache lookup and write, verifies runtime transformations, and tests one predicted identity component at a time. Across five open-source gateways connected to OpenAI and Anthropic, none bound customers to upstream credentials by default; under a shared credential, all five exposed cross-customer cache reads for both providers. Principal and namespace splits, pool associations, and adapter and nested-relay contrasts localized the controlling transformations. In an outcome-independent weekly OpenRouter frame, tests covered 80.5% of eligible
token volume and found cross-account reads for 12 of 28 labels carrying 33.7% of volume. On one production route, a controlled procedure recovered eight consecutive target positions without target access. Broader tests identify cache granularity, routing, rate limits, attribution, and budget as conditions for
token-by-
token recovery, not security controls. We derive a defense contract: every customer must enter a provider-enforced domain, or a namespace derived from authenticated identity must survive every final cache lookup and write. Placing this split after reusable public prefixes preserved most modeled reuse at a 1.7-2.5% cost increase.
Read the full abstract ▾
All authors Bowen Sun, Yixi Cai, Xiaogeng Liu, Zhengyue Zhao, Yinzhi Cao, Chaowei Xiao
Cryptography and Security
Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services
Bowen Sun, Zhengyue Zhao, Xiaogeng Liu et al. (+2 more)
Most large
language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.
Read the full abstract ▾
All authors Bowen Sun, Zhengyue Zhao, Xiaogeng Liu, Yinzhi Cao, Chaowei Xiao
Cryptography and Security
FESC: Remodeling Long-Context Private Inference with Encrypted State-Space Models
Yufan Zhu, Chao Jin, Khin Mi Mi Aung et al. (+1 more)
Processing long, sensitive documents with machine-learning models requires efficient,
privacy-preserving long-context inference. Prior private inference systems optimize or distribute encrypted
Transformer attention, but its quadratic
token-pair work remains the bottleneck as sequence length grows. Selective state-space models (SSMs) offer linear-time recurrence, yet direct encrypted implementation incurs linear multiplicative depth, sequence-wide state residency, or dense FHE-MPC conversion. We present Factorized Encrypted Scan-Contract (FESC), a hybrid FHE-MPC system for private long-context selective SSM inference. Its factorized scan-contract keeps input-dependent transitions compact across conversion boundaries, composes them without dense expansion, streams state chunks on demand, and contracts outputs before conversion. We demonstrate interface compatibility of the scan-contract implementation across invariant and selective SSM architectures. For our Mamba-2 instantiation, we design GPU-optimized CKKS kernels for linear computations, MPC protocols for SiLU, softplus, exponential, and RMSNorm, with approximation-aware fine-tuning. To our knowledge, FESC is the first private long-document inference system to complete native end-to-end execution at $L \geq 1{,}024$ on a single GPU. At $L = 2{,}048$, a 12-layer Mamba-base model completes inference in 77.3 minutes on one A100 GPU with a peak
memory footprint of 32.7 GB, while maintaining near-plaintext accuracy on the evaluated long-document tasks.
Read the full abstract ▾
All authors Yufan Zhu, Chao Jin, Khin Mi Mi Aung, Xiaokui Xiao
Cryptography and Security · Cross-listed from math.PR
On the Pseudo-Mixing of Kac's Walk
Natesh S. Pillai, Aaron Smith and Vinod Vaikuntanathan
Motivated by a
conjecture of Vaikuntanathan and Zamir, we study the pseudo-mixing of Kac's walk on $\mathrm{SO}(n)$: whether short trajectories are indistinguishable from Haar measure by low-complexity tests. We prove that the first $k$ columns mix in Wasserstein distance in $O(n(k+\log n)\log n)$ steps for fixed accuracy, resolving a
conjecture of Oliveira. Combining this with a representation-theoretic variance bound, we show that if $T=\omega(nk(k+\log n)\log n)$, then every degree-$k$
polynomial normalized to have unit Haar variance has expectation under the $T$-step law within $o(1)$ of its Haar expectation. As an application, we show that this pseudo-mixing estimate can be used to prove the effectiveness of a fast Johnson–Lindenstrauss transform with the usual target dimension.
Read the full abstract ▾
Cryptography and Security
Trusted Workflow Relays:Cross-Tenant Email Abuse and Composable Red Team Initial-Access Primitives in Multi-Tenant Clouds
Priyank Nigam
Cloud applications routinely send notifications through provider-operated mail identities, which improves deliverability but separates the actor who supplies notification parameters from the service principal that originates the message. In three responsibly disclosed and remediated cross-tenant notification workflows, an authenticated actor could reach recipients across tenant boundaries and, to varying degrees, control content that a trusted provider service delivered. In the first, backend requests bypassed a UI length limit, raw HTML and CSS survived into the delivered message, attacker links rendered, and CSS could hide service-controlled text; iframes and non-web URI schemes were rejected. The second combined missing recipient-tenant validation with attacker-controlled subject and HTML fields. The third, an approval application, added weak access control, sequential object identifiers, missing action authorization, and incomplete
token validation, composing notification abuse with authorization failures. The pattern is analogous to a classical unauthenticated SMTP open relay, but the failure has moved up the stack: the actor is authenticated and the provider is the legitimate sender, yet application-layer authorization still fails to constrain who may cause it to send what to whom. We define a trusted workflow relay as a delivered, service-authentic message for which the application-level send-authorization predicate is false. We give a test
matrix for notification pipelines, map the primitive to MITRE ATT&CK techniques for attachment-free phishing, and link it to device-code phishing (RFC 8628). SPF, DKIM, and DMARC can authenticate a message yet cannot establish that an application-level send was authorized. We conclude with controls for tenant binding, typed templates, object-level authorization,
token audience validation, and identity telemetry.
Read the full abstract ▾
Cryptography and Security
Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets
Zhida He, Xiaoyu Wen, Han Qi et al. (+5 more)
Reliable jailbreak evaluation is essential for assessing LLM safety, but most existing studies rely solely on attack success rate (ASR) without accounting for its dependence on attack budgets, resulting in unfair comparisons across methods. Existing compute-aware evaluations reduce heterogeneous resources into FLOPs, which is difficult to estimate for black-box models and fails to capture resource-specific constraints. To provide a comparable evaluation basis, we introduce Fair-ASR, an evaluation protocol for black-box jailbreak attacks under shared target-call budgets B, using target calls as a directly observable and method-agnostic comparison axis while tracking attacker calls separately for efficiency analysis. We re-evaluate 11 representative attacks under the Fair-ASR protocol and find that attack rankings change substantially across target-call budgets, simple
stochastic perturbations and hand-crafted templates remain highly competitive under equal target access, and no evaluated LLM-driven method is efficient in both target and attacker calls. Motivated by this efficiency gap, we introduce ReCode, a compositional budget-efficient attack that combines desensitization rewriting with two effective low-cost primitives identified by Fair-ASR. Under a budget of 20 target calls, ReCode achieves 85% ASR on GPT-5 while requiring only 7.19 attacker calls per request on average, showing strong efficiency in both target and attacker calls.
Read the full abstract ▾
All authors Zhida He, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Peng Yu, Jiajia Li, Chaochao Lu, Qiaosheng Zhang
Cryptography and Security
FlowShield: cryptocurrency anti-money laundering with transaction semantics parsing and fund flow tracking
Qishuang Fu, Andreas Deppeler, Joseph K. Liu et al. (+5 more)
Cryptocurrency anti-money laundering (Crypto AML) is increasingly challenged by sophisticated laundering behaviors that rapidly fragment stolen assets through diverse semantics and across multiple blockchains. Existing Crypto AML methods often simplify transaction semantics, rely on
topology-centric signals, or output isolated detection labels. In this paper, we present FlowShield, a Crypto AML framework for transaction-level laundering detection and investigator-facing report generation. FlowShield first recovers behavior-level semantics from observable relations, making laundering intents explicit. To trace value provenance and redistribution, FlowShield reconstructs fund-flow subgraphs from three complementary perspectives. It then employs a text–structure fusion mechanism, enabling the interplay between large
language model (LLM)-encoded semantics and flow texts with graph convolutional network (GCN)-encoded structure. Beyond mere detection, FlowShield further generates readable suspicious activity reports (SARs), offering investigators concise summaries and explainable red flags. To address the data scarcity in multi-chain detection, we construct and open-source BybitML, the first public multi-chain laundering
dataset. We evaluate FlowShield on BybitML and two public laundering
datasets and experimental results demonstrate that FlowShield achieves the best overall performance, with an average F1 score of 98.0%. Further behavior and SAR analyses demonstrate that FlowShield can reveal diverse laundering strategies and produce readable reports for investigating complex multi-hop fund flows.
Read the full abstract ▾
All authors Qishuang Fu, Andreas Deppeler, Joseph K. Liu, Yixin Liu, Shirui Pan, Qin Wang, Weiqing Wang, Tsz Hon Yuen