Cryptography and Security
Who Judges the Judges? A Chinese Safety QA Benchmark for Evaluating LLM Responses and Safety Judges
Rui Yang, Shuang Huang, Junhua Liu et al. (+7 more)
Safety
benchmarks for large
language models often assess the risk of a user query, although the outcome of question answering depends on whether the response violates a policy. This distinction is critical in Chinese harmful-content evaluation, where linguistic variation and
adversarial transformations can obscure risky intent. We introduce C-SafeQA, a policy-grounded
benchmark for response-level Chinese safety evaluation. It comprises 538 base queries and 8,877
adversarial queries answered by four full-model LLM deployments, yielding 37,660 query-response records labeled safe, unsafe, or disputed. Reference labels are generated through agreement-aware multi-model adjudication and blind audits of stratified subsets by three safety experts. C-SafeQA supports both evaluation of target-model safety and auditing of seven automated safety judges against shared reference labels. Unsafe-response rates range from 0.93% to 3.35% on base queries and from 11.68% to 30.05% on
adversarial queries. On the
adversarial subset, judges show substantial trade-offs between unsafe-response recall and risk-query-conditioned safe-response false positive rate, and no judge dominates all metrics. Both acrostic transformations reduce unsafe recall for all seven judges, revealing mechanism-specific evaluator weaknesses.
Dataset records, metadata, verification code, and judge scripts are publicly released to support recomputation, while
benchmark construction, target-response generation, and private adjudication remain outside the release boundary.
Read the full abstract ▾
All authors Rui Yang, Shuang Huang, Junhua Liu, Ziqi Zhao, Qingzhong Yan, Yuhang Sun, Cong Liu, Guoping Hu, Rui Mei, Jing Shao
Cryptography and Security
Identification of Compositional Risks in Data Protection Impact Assessments and Beyond
Henrik Graßhoff, Meiko Jensen, Malte Hansen et al. (+1 more)
When personal data is processed in a distributed manner by cooperating service providers,
privacy risks may emerge solely from the choice of data processors included in the composition. For instance, different data processors may unknowingly rely on the same cloud provider, allowing for unintended linkability of personal data at that very provider. As such compositional risks to
privacy are beyond the scope of each individual risk assessment, they are likely to be overseen when performing a data protection impact assessment. In this paper, we propose a novel protocol to detect and manage such compositional risks to
privacy. Following an initial problem definition and requirements elicitation, we elaborate how our protocol identifies candidates for compositional risks and how this information may be used to improve the results of a data protection impact assessment over service compositions including multiple data processors.
Read the full abstract ▾
All authors Henrik Graßhoff, Meiko Jensen, Malte Hansen, Nils Gruschka
Cryptography and Security · Cross-listed from cs.FL
Verification of $K$- and Infinite-Step Strong/Weak Anonymity Using Concurrent Compositions
Jiahui Zhang, Kuize Zhang, Xiaoguang Han et al. (+1 more)
Anonymity is an information flow property that provides
privacy protection in the sense of non-uniqueness of system information at certain moments with respect to observations. The notion of $K$-step anonymity in the context of discrete-event systems characterizes the scenario that the state estimates cannot be a singleton within at most $K$ observational steps prior to the current instant, while infinite-step anonymity is the same as $K$-step anonymity without considering the limit on $K$. In this paper, we lucubrate $K$- and infinite-step anonymity for partially-observed discrete-event systems modeled by non-deterministic finite-state automata. First, we define two strong types and two weak types of $K$- and infinite-step anonymity that are fundamentally different from the existing notions of $K$- and infinite-step anonymity due to the consideration of strong and weak anonymous projections. Then, we develop a new methodology by exploiting the concurrent-composition technique to verify these four types of anonymity. Based on the constructed concurrent compositions, verifiable necessary and sufficient conditions for the four types of anonymity are provided, along with their complexity analysis. Finally, the upper bounds on $K$ for $K$-step strong anonymity and weak anonymity are computed.
Read the full abstract ▾
All authors Jiahui Zhang, Kuize Zhang, Xiaoguang Han, Zhiwu Li
Cryptography and Security · Cross-listed from cs.SE
Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion
Phong Trinh Duy, Trang Dang Yen, Hung Nguyen-Huu et al. (+5 more)
A single vulnerability in a widely used library can cascade through millions of dependent applications, yet more than half of vulnerability database entries contain missing or incorrect affected-library information. Existing automated approaches neglect the relational structure of vulnerability databases, treating identification as an isolated text
retrieval problem. In this paper, we propose Athena, the first graph-based approach for vulnerability affected library identification. Athena models vulnerability databases as a knowledge graph and reformulates the identification problem as knowledge graph completion (KGC). It comprises three key modules: a Modeling module that constructs a security knowledge graph integrating CVEs, libraries, CWE weakness types, CPE products, and software ecosystems; a Completion module that applies a modular KGC backbone to predict missing affected libraries for a given CVE via link prediction; and a Re-ranking module that retrieves KGC candidates and rescores them using a fine-tuned LLM augmented with knowledge graph
embeddings, jointly leveraging structural and textual information. Our experiments on VulLib demonstrate that Athena significantly outperforms four state-of-the-art baselines, achieving a 32% improvement in Avg. F1 over the best baseline (i.e., VulLibGen). Notably, our KGC backbone with only 110M parameters already surpasses VulLibGen's best configuration at 7B parameters, demonstrating the effectiveness of graph-based modeling; the re-ranking module then provides substantial further gains, consistently outperforming the best baseline across all evaluated LLM backbones.
Read the full abstract ▾
All authors Phong Trinh Duy, Trang Dang Yen, Hung Nguyen-Huu, Bach Le, Quyet-Thang Huynh, Dieu Hoang Vu, David Lo, Thanh Le-Cong
Cryptography and Security
Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations
Monika di Angelo and Gernot Salzer
The Common Vulnerabilities and Exposures (CVE) database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated
dataset of CVE records up to July 2026 referring to Ethereum smart contracts. The
dataset contains the vulnerable artifacts (source code and runtime bytecode), labels according to three taxonomies, and function-level locations. The
retrieval of CVE records, collection of additional evidence, validation of the correspondence between records and artifacts, label assignment, and vulnerability localization are automated, leaving 15% to manual analysis. The
dataset does not validate the original vulnerability claims, but marks a few records obviously wrong as `refuted'. For the sake of reproducibility, all external inputs are retained, so that rerunning the pipelines results in the same outputs. The
dataset comprises 491 records linked to deployed contracts, 26 referring to projects (mostly libraries), 45 without validated artifacts, and six records with refuted claims. The
dataset supports empirical security research, in particular the evaluation of code analysis and repair techniques.
Read the full abstract ▾
Cryptography and Security
Reveree: Diagnosing LLM Reverse-Engineering Agents
Hadjer Benkraouda, Hongyu Cai, Berkay Celik et al. (+1 more)
Reverse engineering (RE) is critical to security tasks such as malware analysis and vulnerability discovery, and large
language model (LLM)
agents are increasingly able to perform it autonomously. Capture-the-flag (CTF) RE challenges have become the standard proxy for measuring this capability, but evaluation rests on a single criterion: whether the
agent captures the flag. This solve rate reveals neither where in the RE process an
agent fails nor whether a success reflects analysis of the binary or recall of a public solution. In this paper, we propose Reveree, a diagnostic framework that scores an LLM RE
agent's trajectory at three tiers: solve rate, milestone progress through an eight-stage RE schema, and a behavioral profile of its actions. Comprehension stages are scored by an outcome-blinded LLM judge validated against a human expert; all other stages are verified deterministically. Using Reveree, we evaluate nine frontier models and four prompting strategies on 88 picoCTF and NYU-CTF challenges. We find that the base model dominates performance, whereas prompting strategy is a secondary, model-dependent effect. Surprisingly, larger, newer, or costlier models are not reliably stronger. We also find that failures concentrate at the comprehension stages of the RE process, and that extra budget, persistence, or
reasoning effort rescues few of them, pointing to a competence limit rather than a resource limit. Regarding memorization, while models reproduce picoCTF flags from challenge descriptions alone, NYU-CTF shows minimal measurable recall, and most solves survive surface perturbation, indicating that genuine analysis coexists with memorization. We release Reveree to the community.
Read the full abstract ▾
All authors Hadjer Benkraouda, Hongyu Cai, Berkay Celik, Gang Wang
Cryptography and Security
A SoK for SoCs: Reading the TI Leaves on AI for Cyber Threat Intelligence Generation and Sharing
Saastha Vasan, Hadjer Benkraouda, Jizhou Chen et al. (+8 more)
Cyber Threat Intelligence (CTI) is essential for defending mission-critical infrastructure, yet the process of transforming raw attack evidence into shareable CTI remains fragmented and understudied. We conduct a literature survey of academic papers, organizing the CTI lifecycle into three stages: Threat Data Collection, CTI Generation and Sharing, and CTI Consumption. The first and third stages are well represented in the literature, whereas only a small number of papers address CTI Generation and Sharing. To learn how this stage is practiced, we survey practitioners across multiple organizations who routinely generate and share CTI. They describe a largely manual process with four recurring challenges: preventing the exposure of sensitive information, extracting indicators from noisy attack data, correlating observed behavior with standardized tactics, techniques, and procedures (TTPs), and translating CTI into the formats that sharing platforms require. Using the insights from the practitioner survey, we divide the CTI Generation and Sharing stage into four steps: Intelligence Extraction, Normalization and Enrichment, Codification, and Distribution. We then conduct pilot studies that probe the feasibility of current Large
Language Models (LLMs) for each step. The pilot studies show that LLMs can assist an analyst in each of the four steps. However, the models recover only a fraction of the indicators the evidence contains, struggle to ground every claim in the supplied evidence, and do not judge what keeps shared intelligence useful to its recipients. Each step therefore requires expert supervision. Based on these observations, we derive three research directions for automating the production of shareable intelligence.
Read the full abstract ▾
All authors Saastha Vasan, Hadjer Benkraouda, Jizhou Chen, Leyan Pan, Doguhan Yeke, Shinan Liu, Noah Spahn, Stefano Ortolani, David Evans, Christopher Kruegel, Giovanni Vigna
Cryptography and Security
Johnny Still Receives Spam SMS: Assessing the Robustness of SMS Spam Detection
Muhammad Salman, Muhammad Islam, Muhammad Ikram et al. (+1 more)
SMS spam detection systems often achieve high accuracy in controlled environments but struggle against
adversarial attacks and increasingly sophisticated spam tactics in real-world deployments. In this paper, we evaluate the robustness of SMS anti-spam systems that end users actually rely on, including commercial messaging applications, third-party anti-spam services, and publicly available open-weight models hosted on Hugging Face. We evaluate these systems under both standard and
adversarial conditions, considering perceptible and state-of-the-art imperceptible attacks. We include only perturbations that we verify survive real SMS or RCS delivery, rather than lab-only artifacts. Our experiments reveal significant gaps in existing spam detectors' ability to identify adversarially manipulated messages. We further demonstrate that
adversarial training alone is insufficient. Using an explicit held-out evaluation protocol, we find that robustness transfers well within a perturbation family but degrades sharply against structurally distinct, encoding-level attacks. To address these weaknesses, we propose a multi-model ensemble that combines
adversarial training with spam classifiers diverse in architecture and tokenization. Our results show that this ensemble, particularly when using a minority-voting strategy, substantially improves robustness against both perceptible and imperceptible
adversarial attacks while maintaining competitive classification accuracy. We also characterize the resulting precision-recall trade-off and recommend operating points for false-positive-sensitive and recall-critical deployments. These findings highlight the need for comprehensive robustness evaluations and ensemble-based defenses for building more secure SMS spam detection systems in real-world settings.
Read the full abstract ▾
All authors Muhammad Salman, Muhammad Islam, Muhammad Ikram, Mohamed Ali Kaafar
Cryptography and Security · Cross-listed from cs.NI
Sentinel-Based Failover for QKD-Augmented IPsec Tunnels
Juan Carlos Hernandez-Hernandez, Francesco Vista, Haftay Gebreslasie Abreha et al. (+3 more)
Quantum-safe IPsec through hybrid key establishment is practical, but creates a critical operational challenge: how to maintain tunnel availability when the QKD infrastructure becomes unavailable. In this paper, we present the design, implementation, and experimental evaluation of a
quantum-safe key establishment mechanism for an IPsec tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism, and that degrades gracefully when the QKD key delivery fails. Our open-source StrongSwan plugin uses a sentinel-based coordination protocol, thereby permitting us to complete the handshake even if the QKD leg fails, instead of aborting, restoring the QKD share at the next rekey. On a testbed connected to a metropolitan QKD link over 33 km of deployed fiber, we evaluated five configurations, from a classical X25519 with RSA baseline to a hybrid one that adds ML-KEM-1024 and a QKD key. The full hybrid authentication costs 103 ms against 61 ms for the baseline, the QKD
retrieval itself adds only about 7 ms. Failure injection experiments confirm that the tunnel survives a complete KME outage without any interruption of the protected traffic.
Read the full abstract ▾
All authors Juan Carlos Hernandez-Hernandez, Francesco Vista, Haftay Gebreslasie Abreha, Intidhar Bedhief, Seid Koudia, Symeon Chatzinotas
Cryptography and Security · Cross-listed from cs.PL
Griotte: Verified Compartmentalisation via Capabilities
June Rousseau, Aïna Linn Georges, Jean Pichon-Pharabod et al. (+1 more)
CHERIoT is a novel hardware-software co-design that leverages hardware capabilities to define a notion of compartment, in a minimalistic capability-based OS, CHERIoT RTOS. By default, compartments are isolated to limit damage in case of bugs or malicious behaviour. To allow cross-compartment communication, the OS provides a privileged component, called the switcher. The switcher provides an interface for cross-compartment calls, while enforcing isolation between compartments and guaranteeing stack safety. Together with hardware capabilities, the switcher is critical to enforce the security guarantees of the CHERIoT compartment model. The design of CHERIoT raises two questions: First, how can one formalise the informal notion of compartmentalisation that CHERIoT compartments are designed to provide? And second, given that the safety properties of CHERIoT hinge on the complementary roles of the capability machine and of the switcher, does the design of CHERIoT enforce the desired security properties? In this paper, we introduce Griotte and Griotte OS, idealised but faithful versions of the CHERIoT machine and the CHERIoT RTOS, which we use to answer these two questions: First, we formally capture the aforementioned security guarantees in the form of a continuation-based logical relation which captures the combined behaviour of the switcher and of the capability machine. And second, we define a specification for the Griotte switcher that enforces those guarantees, and prove that the implementation meets the specification. We demonstrate Griotte on a range of key scenarios illustrating different aspects of CHERIoT, including integrity of the local state in the presence of
memory sharing with unknown code. Our approach is modular: we verify compartments individually, and then compose their specifications. Together, our contributions give a solid formal foundation to the design of CHERIoT.
Read the full abstract ▾
All authors June Rousseau, Aïna Linn Georges, Jean Pichon-Pharabod, Lars Birkedal
Cryptography and Security
CRSF: Collusion-Resilient Privacy-Preserving Sensor Fusion with Byzantine-Robust Participation
Chao Yin, Haihong Tian, Zheng Yang et al. (+3 more)
Privacy-preserving sensor fusion enables an untrusted server to compute an aggregate result over distributed sensor measurements without learning either individual inputs or the final output. Recent garbled-
circuit-based protocols provide an efficient realization of this functionality in a sensor–server–client architecture, but remain vulnerable to sensor–server collusion and Byzantine manipulation of sensor participation. These weaknesses can compromise honest-sensor
privacy, incorrectly exclude honest sensors, and corrupt the computed fusion result, thereby undermining the security guarantees expected from the protocol. We present CRSF, a collusion-resilient sensor-fusion protocol that addresses these weaknesses while providing
privacy, correctness with explicit abort, and liveness. CRSF introduces a Practical Byzantine Fault Tolerance (PBFT)-based agreement phase for sensor submissions and uses server-specific, status-dependent label release with threshold protection of
circuit-input labels. This design prevents any Byzantine server from unilaterally manipulating sensor participation and prevents any admissible sensor-server coalition from obtaining enough secret material to compromise honest-sensor
privacy. We implement CRSF and compare its online execution time with the most relevant state-of-the-art baseline. Our Google Cloud evaluation measures the total computation and communication cost of the online protocol under fault-free and representative faulty executions. Across a range of fault-tolerant fusion
circuits and up to 261 sensors, CRSF demonstrates a highly practical trade-off between robust security and protocol performance.
Read the full abstract ▾
All authors Chao Yin, Haihong Tian, Zheng Yang, Haibin Zhang, Fabio Massacci, Chenglu Jin
Cryptography and Security
JENGA: Exploiting Counter-Based RowHammer Countermeasures to Break Real-Time Predictability
Valentin Abgrall, Marcello Traiola, Ruben Salvador et al. (+3 more)
Safety-critical real-time systems must satisfy multiple dependability requirements, notably time predictability and security. In such systems, tasks must complete within bounded and known execution times, typically characterised through Worst-Case Execution Time (WCET) analysis. At the same time, DRAM-based platforms are increasingly sensitive to the RowHammer read-disturbance security vulnerability, which has motivated the development of numerous hardware and software countermeasures in both academia and industry. However, the impact of these defences is generally evaluated in terms of average-case performance, a metric that is insufficient for safetycritical real-time systems, where worst-case behaviour is the primary concern. In this paper, we study the impact of RowHammer countermeasures based on hardware counters on the timing behaviour of real-time systems. We use a Per-Row-Activation-Counter (PRAC) countermeasure as a case study, standardised for recent DDR5
memories, and show that it can introduce significant timing variations. Based on this observation, we introduce JENGA, an attack in which an attacker-controlled task manipulates the internal state of the RowHammer countermeasure mechanism to increase the execution time of a victim real-time task beyond its expected WCET. We implement JENGA in a gem5 and Ramulator 2.0 simulation environment and evaluate its impact on TACLeBench workloads. We show that such an attack can delay tasks up to 200% of their WCET, making the initial timesafety assumptions unsafe. To address this issue, we derive a safe analytical bound that accounts for mitigation-induced delays in WCET analysis for DRAM systems protected by hardware countermeasures, such as PRAC-N.
Read the full abstract ▾
All authors Valentin Abgrall, Marcello Traiola, Ruben Salvador, Maria Méndez Real, Alessandro Palumbo, Angeliki Kritikakou
Cryptography and Security · Cross-listed from cs.NI
Lacan: Making Accountability in Anonymous Networks Real
Naoya Takada, Yutaro Yoshinaka, Kentaro Kita et al. (+3 more)
Anonymity and accountability are essential properties for our everyday activity on the Internet. However, they appear contradictory, and their reconciliation remains far from reality. Existing approaches fall short in this regard, as they either rely on an on-path trustee, per-packet authorization, per-packet public-key cryptography, or per-session intervention by a central authority. We propose Lacan, a protocol that reconciles anonymity and accountability within a realistic design. In Lacan, a sender enjoys anonymity provided by on-path relays, as long as she complies with a contract established with the receiver. Upon a contract violation, the verifier, an off-path trustee on behalf of the receiver, links the malicious message to the sender's identity indirectly via the packet, path, and session, thereby reducing public-key operations from per-packet to per-session. This linkage remains robust even against malicious relays and receivers, grounded in our novel chain of successor proofs for accountable path reconstruction, together with traceable signatures, path validation, and key-committing encryption. We analyze the anonymity and accountability, implement the protocol, and evaluate the performance.
Read the full abstract ▾
All authors Naoya Takada, Yutaro Yoshinaka, Kentaro Kita, Junji Takemasa, Yuki Koizumi, Toru Hasegawa
Cryptography and Security
What Limits Robustness in Deep Image Watermarking: An Analysis of Mechanisms and Their Scaling Across Capacities
Marta Bistroń and Zbigniew Piotrowski
Robustness remains the principal open problem in deep image watermarking, and what limits it becomes sharper as payload grows. This paper asks whether capacity is itself the limit or only makes other limits visible, and answers in two parts. The first organizes the distortions a watermark must survive and the strategies developed to resist them, ordering each by the axis that governs it: payload capacity for the distortions, differentiability for the strategies. The second identifies and measures three mechanisms that limit robustness in schemes mapping the payload onto a spatial block grid with extraction trained separately from a frozen embedder: desynchronization of the payload grid, the resistance of codec-induced distortion to training, and the narrowing of the usable
embedding-strength window. Payloads from 64 to 16384 bits are measured, well beyond the range those strategies address. Training the extraction stage against a codec proves not merely ineffective but harmful, degrading the reading at the operating points used in training. The limits follow the class of distortion rather than capacity itself, and none is removed by further training on the extraction side, because all three arise before extraction. An evaluation protocol making claims of generalization verifiable is also contributed. The conclusions are properties of a class of designs rather than of one implementation.
Read the full abstract ▾
Cryptography and Security
HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation
Nikita Oblakov, Sabrina Sadiekh and Evgeniy Kokuykin
Production LLMs must handle inputs that attempt to override system instructions, bypass safety policies or elicit harmful responses. A common mitigation is a separate guardrail model. Existing reports, however, provide little evidence on Russian
prompt injection or Russian surface obfuscation. We present HiveTraceGuard-Pro, a 0.6B generative guardrail LoRA-tuned from Qwen3-0.6B. It is trained on Russian and English and uses one binary scoring rule (safe/unsafe) for the final target turn. Its training corpus pairs harmful examples, where a counterpart exists, with benign examples from the same domain and applies eight obfuscation transforms to both labels. In one harness, we compare HiveTraceGuard-Pro with thirty-four other guards on nineteen
benchmark groups, sixteen of which are public. Its aggregate key is 0.7432, behind 0.7641 and 0.7552 for the two higher-scoring guards. Over the sixteen public groups alone, its key is 0.7153 and four of the thirty-four other suite guards score higher. In a fifteen-model comparison, HiveTraceGuard-Pro has the highest clean Russian robustness combined-F1 (0.88) and Russian
prompt-injection recall (0.999). Both results use Russian sets assembled by our team, and at least 27.1% of the
prompt-injection set overlaps the training corpus. Its 14.3 ms median latency is the lowest among those fifteen models in that run. Across the suite, FPR is 0.268 and FNR is 0.156. All reported response results use a legacy standalone-reply serialization rather than the natural assistant-role path of the shipped chat template. We release the merged weights on Hugging Face under Apache-2.0. The corpus, evaluation sets and evaluation code remain internal.
Read the full abstract ▾
Cryptography and Security
MultiGait: A Multi-Sensor Multi-Perspective Multi-Session Biometric Inference Benchmark and its Dataset
Julian Todt, Felix Morsbach, Philip Dissert et al. (+1 more)
A lack of suitable
datasets has limited the research into the
privacy risks of novel smart city sensors, such as thermal cameras, depth cameras, and
lidar. Given the number of unsubstantiated
privacy claims and their potential widespread deployment into many people's everyday life, understanding the
privacy risks of these sensors – in isolation and in like-for-like comparisons – is crucial. With MultiGait, we collected the first multi-sensor, multi-perspective, multi-session gait-focused
dataset, for the corresponding, and additional more far-reaching investigations. The
dataset, validated with multiple state-of-the-art recognition systems, comprises various walking modes and annotated personal attributes for 199 individuals, to ensure the benefit for advanced studies including cross-sensor recognition and anonymization at the edge. MultiGait represents a foundation for rigorous
privacy investigations, demonstrated through an extensive identity inference
benchmark across eight sensors, four perspectives, and three recording sessions. Our
benchmark incidentally reveals that sensors often assumed to be
privacy-friendly do still entail considerable identity inference risks, while the poor cross-session generalization of existing methods underscores an important research gap.
Read the full abstract ▾
All authors Julian Todt, Felix Morsbach, Philip Dissert, Thorsten Strufe
Cryptography and Security
AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs
Chua Jin Chou, Sarang Nambiar, Murali Srinivasan et al. (+1 more)
We present AKRASIA, a stealthy, inference-time backdoor attack against
reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target (e.g., malicious code execution) in
reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to construct a code-level backdoor trigger. It then employs in-context learning for backdoor learning, and model unfaithfulness to conceal the backdoor trigger, and generate plausible
reasoning. We evaluate AKRASIA using four backdoor targets six (6)
reasoning LLMs, three coding tasks/
datasets and three defense methods. AKRASIA has up to 99.34% average attack success rate on SOTA LLMs and mantains up to 97.23% average accuracy. AKRASIA evades the SOTA defense, retaining up to 98.82% average ASR in most (14/18) defense settings. It evades human inspection, successfully hiding the backdoor trigger and
reasoning steps in up to 80% of settings. Our findings motivate the need to defend LLMs against
reasoning backdoors.
Read the full abstract ▾
All authors Chua Jin Chou, Sarang Nambiar, Murali Srinivasan, Ezekiel Soremekun
Cryptography and Security
Influence of Logging Frameworks on Bind9
Max Schrötter, Hannes Signer and Bettina Schnor
Host-based Intrusion Prevention Systems (IPS) rely on application logs to detect and block malicious activity. However, on modern high-speed networks the logging subsystem itself becomes a bottleneck: an attacker can hide traces simply by generating enough traffic to overwhelm the application's log pipeline, dropping crucial traces. In this work, we show that widely deployed setups such as Fail2Ban monitoring BIND9 can be defeated with less than 65 Mbps of DNS traffic. Further, we show that when replacing core components of the IPS architecture with their higher-performance equivalent, iptables with eBPF and regex matching with Hyperscan, the logging backends themselves become the bottleneck. Therefore, we present FIPS, a new IPC designed for high-performance logging that bypasses the kernel and reduces copying of the log messages to a minimum. FIPS uses per-thread lock free shared
memory ring buffers, supporting multiple independent consumers reading the same log stream at their own pace. FIPS offers both a native API and a drop-in replacement for the syslog interface. Our evaluation with BIND 9 shows that FIPS introduces almost no overhead compared to disabled logging, logs more requests than any other evaluated framework, and enables the IPS to ban malicious clients $2.5\times$ faster than with file logging while sustaining $2^{16}$ attacking clients at one million requests per second.
Read the full abstract ▾
Cryptography and Security · Cross-listed from q-fin.RM
Pricing the DeFi Tail: Do Protocols or Depositors Price Operational Risk?
Nils Bundi
Similar to banks, DeFi protocols expose depositors to operational risk (USD 9.45 billion across 1,075 events since 2020). Unlike banks, they are not required to hold capital against it. A protocol may maintain a buffer voluntarily. Absent one, the risk falls on the depositor, who should then demand a risk premium in the supply yield. I quantify the underlying tail on one
benchmark, a per-sector Basel loss-distribution approach fitted to a new operational risk event
dataset, and test both margins against it. Tails in the four core sectors are no heavier than the Moscadelli banking band $[0.85, 1.39]$. Bridge, Derivatives, and the residual Other sector exhibit cyber-loss-level tails ($\hat\xi \approx 1.6$), with point estimates past the infinite-mean boundary. The Lending tail implies a $\mathrm{VaR}_{99.9}$ capital buffer of 18% of TVL and of the ten largest Lending venues, the four holding a buffer cover on average 5% of it. Under
market discipline, depositors should demand a higher yield in compensation where a venue does not maintain a buffer. I find that venues without a buffer pay a higher premium than those with (a 125-bps gap in medians): evidence the
market discriminates in the right direction. However, the premium falls far short of an adequately priced tail. This unpriced tail falls disproportionately on the retail depositor, who sees only the posted rate but lacks the information and skills to price it. Because these products are not bank-regulated, I recommend disclosure over capital mandates: protocols, and any service providers that front access to it, should publish standardized losses, existing capital buffers and tail coverage.
Read the full abstract ▾
Cryptography and Security
Using LLMs to Elicit Security Requirements for Service-Oriented Cyber Ranges
Michail Takaronis, Athanasia Kollarou, Georgios Kavallieratos et al. (+2 more)
Cyber ranges are complex environments comprising many interacting components and stakeholders with different security concerns. The Service-Oriented Cyber Range (SOR) is no exception, particularly when it comes to training scenarios targeting critical infrastructure. Security concerns are translated into security requirements, the elicitation of which is usually difficult and time-consuming. This work examines how large
language models can assist in eliciting security requirements for a service-oriented range and help produce a useful baseline for designers and developers. The approach follows a SEBoK-guided process in which security mission objectives and stakeholder needs were first identified and then provided as a
prompt context along with architectural guidelines to five LLMs: GPT-5.2, Gemini 3.1 Pro, Grok 4.1, Sonar, and Kimi K2.5. The models generated 84 security requirements in total, which were consolidated into a comprehensive set of 27 requirements and then mapped to the architectural layers of the service-oriented range. The final set was evaluated by five cybersecurity experts against the criteria of necessity, clarity, completeness, feasibility, and testability, with an additional rejection option. The results showed a high acceptance rate, specifically for necessity with 98.5%, clarity with 87.4%, completeness with 85.2%, feasibility with 78.5%, and rejection with 0.7%. Testability was lower at 44.4%, indicating a slight lack of information on how these requirements could be tested. These findings show that LLMs can support early stages of the elicitation of security requirements, although human review is still needed, especially to improve or adjust certain aspects of the requirements.
Read the full abstract ▾
All authors Michail Takaronis, Athanasia Kollarou, Georgios Kavallieratos, Vasileios Gkioulos, Sokratis Katsikas
Cryptography and Security · Cross-listed from cs.CL
Membership Inference in Fine-tuned Diffusion Language Models via Token-level Memorization Asymmetry
Shengfang Zhai, Leo Marchyok, Yuling Shi et al. (+4 more)
Diffusion language models (DLMs) have recently emerged as an alternative modeling paradigm to autoregressive LMs, offering advantages such as parallel generation and bidirectional context modeling. Despite growing interest in their generative capabilities, the
privacy risks of DLMs remain underexplored. We identify a phenomenon termed
token-level memorization asymmetry through theoretical analysis of
diffusion training dynamics. Building on this finding, we propose Q-Skew, a
quantile-weighted skewness-based indicator for membership inference on finetuned DLMs. Experiments across multiple fine-tuning
datasets and models show that our method outperforms existing baselines. Moreover, we show that Q-Skew can also facilitate other
privacy violations, such as PII extraction. Our findings reveal a previously underexplored
privacy attack surface and highlight the need for systematic
privacy evaluation of DLMs.
Read the full abstract ▾
All authors Shengfang Zhai, Leo Marchyok, Yuling Shi, Huanran Chen, Yinpeng Dong, Jiaheng Zhang, Sanghyun Hong
Cryptography and Security
Effective Interventions Against AI-Enhanced Scams
Kyle Fredrickson
In 2025, scams were responsible for an estimated $442 billion in direct losses globally. In the United States, reported losses increased by nearly 400% between 2020 and 2025. Though AI in scamming is a relatively new phenomenon, its use significantly changes the economics of scams as well as the bottlenecks in scam operations. In this paper I investigate what interventions will remain effective under this new AI-driven scamming regime. I develop a simple model of scam profits to understand how different interventions asymptotically affect scam operations. I find that three levers–reporting rate, centralization of reporting, and report accuracy–multiply in their effect on expected victims per scam channel, reducing revenue per scam channel while increasing costs. Because effects multiply, interventions affecting all three could have a significant effect on the profitability of the scam business model. My analysis suggests that even modest reporting rates against high-value scam infrastructure could have significant impacts on scam profitability.
Read the full abstract ▾
Cryptography and Security
RISA: Response Inspection and Selective Actions for Refusal Calibration in Large Language Models
Wenhan Chang, Tianqing Zhu, Ping Xiong et al. (+2 more)
Reliable refusal behavior requires Large
Language Models (LLMs) to reject harmful
prompts with only answering benign ones. Incorrect refusal behavior can either expose users to harmful responses or prevent users from obtaining useful answers. Training-time
alignment improves refusal behavior by updating model parameters with safety data, but requires additional computation and training. In contrast, inference-time
alignment aims to modify LLM behavior during inference without updating the underlying model parameters. Existing inference-time methods mainly rely on in-context safety prompting, activation steering, or decoding control. However, most of them intervene without first determining whether the initial response is already appropriate, potentially altering a correct refusal or a useful answer. Effective selective intervention therefore requires identifying
prompt intent beyond sensitive keywords, covering semantic variations that fixed rules may miss, and adapting the verifier to different base models. To address these challenges, we propose Response Inspection and Selective Actions (RISA), an inference-time framework that inspects the initial response and selectively corrects refusal errors without updating the base model. RISA first uses fixed contextual rules to assign refusal scores to clear cases. For unmatched cases, it derives a refusal score from the final-layer
prompt hidden state using a calibrated linear probe. To adapt to different base models, RISA separately calibrates the probe score, representation-support boundary, and action thresholds. At runtime, RISA combines the
prompt score with the initial refusal status and applies an action policy to intervene only when necessary. Experimental results demonstrate that RISA improves refusal reliability while largely preserving model utility, offering a practical solution for response-aware refusal calibration in LLMs.
Read the full abstract ▾
All authors Wenhan Chang, Tianqing Zhu, Ping Xiong, Shiyi Liao, Wanlei Zhou
Cryptography and Security
MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC
Seongkyu Yang, Hyeonho Noh, Hyun Jong Yang et al. (+1 more)
Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input–output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10
datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.
Read the full abstract ▾
All authors Seongkyu Yang, Hyeonho Noh, Hyun Jong Yang, Jonggyu Jang
Cryptography and Security
SoK: Motion Data Privacy in Extended Reality
Azim Ibragimov, Alina Vasina, Uliana Polshcha et al. (+1 more)
Extended Reality (XR) provides immersive, interactive 3D experiences. To enable these experiences, the devices must track user motion so the system can respond to actions such as grabbing, looking at, or moving an object. However, motion tracking has raised
privacy concerns since it records a person's motion patterns. These motion patterns have been studied extensively across various fields (i.e., gait identification and profiling) and have been shown to reveal sensitive information. With the adoption of XR, these patterns became easier to record and obtain than ever. This creates a fundamental
privacy tension: motion tracking enables core XR functionality yet requires users to compromise their
privacy. Prior systematization-of-knowledge (SoK) studies on XR
privacy have examined the field broadly, with motion-related research distributed across several
privacy domains rather than treated as a distinct area of study. However, XR motion
privacy has gained significant momentum since the prior SoK, with the literature nearly quadrupling in size and thereby warranting a dedicated systematization of this topic. This SoK examines 134 relevant papers on
privacy concerns in motion patterns recorded by XR headsets, including how adversaries can obtain users' motion patterns, the inferences they can draw from them, and methods for protecting users. Based on this review, we synthesize a taxonomy of motion modalities, representations, and inference risks; develop an XR motion threat model; systematize the attack and defense approaches in the XR motion literature; identify gaps in the literature; and provide guidelines for future studies evaluating motion
privacy mechanisms. Together, our SoK clarifies the state of XR motion
privacy and provides recommendations for future evaluations.
Read the full abstract ▾
All authors Azim Ibragimov, Alina Vasina, Uliana Polshcha, Eric D. Ragan
Cryptography and Security
Differentially Private Paired Table-Image Multimodal Synthesis
Kai Chen, Josephine Lamp, Somesh Jha et al. (+1 more)
Differentially private (DP) synthesis has been extensively studied for tabular and image data separately, yet many real-world
datasets contain images paired with multivariate tabular records. Synthesizing such data is particularly challenging under DP, as the two modalities favor different private learning mechanisms while their dependence must also be preserved. To address this challenge, we propose DP-TabImage, a modality-specialized framework for private paired synthesis. DP-TabImage instantiates the factorization $p(x,y)=p_T(y)p_I(x\;|\;y)$ using a private Probabilistic Graphical Model for the multivariate table distribution and a table-conditioned
diffusion model trained with DP-SGD for the conditional image distribution. To facilitate conditional learning under clipped and noisy gradients, we further pretrain the model on private table-image prototypes, pairing privately constructed attribute-conditioned images with tabular vectors derived from the already private tabular model at no additional
privacy cost. Experiments on three real-world
datasets show that DP-TabImage achieves a strong balance among tabular fidelity, image fidelity, and cross-modal
alignment. Our analysis further reveals that visual warm-up primarily improves marginal image fidelity, whereas aligned table-image warm-up is critical for improving cross-modal correspondence. Our source code is available in the GitHub repository, https://github.com/KaiChen9909/TabImage_Syn.
Read the full abstract ▾
All authors Kai Chen, Josephine Lamp, Somesh Jha, Tianhao Wang
Cryptography and Security
PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation
Md Ajwad Akil, Adrian Shuai Li, Imtiaz Karim et al. (+3 more)
Prior
adversarial attacks on Windows PE malware detectors target raw bytes, PE headers, or intra-function control-flow graphs, leaving the function call graph (FCG) unexplored as an attack surface. Yet the FCG structure is an important feature in graph-based malware detectors. We present Phan- tomCall, a black-box attack that perturbs the FCG of Windows PE malware by injecting fully executable dummy functions at targeted call sites, adding new nodes and edges to both the CFG and FCG while preserving program semantics. We pair this structural perturbation with classifier-guided search and tunable injection parameters, effective across three archi- tecturally distinct classifiers. Evaluated on a 2025-collected Windows malware corpus against MalConv (raw-byte CNN), MalGraph (graph-based GNN), and SAFE+GNN (pure FCG GNN trained from scratch on a 2024 corpus) at two FPR thresholds, the best PhantomCall variant achieves 85-100% attack success rate across all configurations, exceeding prior state-of-the-art by up to 14.78 percentage points on MalGraph and 95.5 percentage points on SAFE+GNN, and generating evasive variants up to 2.9x faster on average across all targets. For MalConv and MalGraph, the majority of evasions require only a single call site modification, and 86-97% of evaluated evasive variants preserve the original malicious behavior in sandbox-based semantic testing across all configurations.
Read the full abstract ▾
All authors Md Ajwad Akil, Adrian Shuai Li, Imtiaz Karim, Arun Iyengar, Ashish Kundu, Elisa Bertino
Cryptography and Security
Automating Static Code Analysis Through CI/CD Pipeline Integration
Zachary Wadhams, Ann Marie Reinhold and Clemente Izurieta
In the contemporary landscape of software devel-opment, securing sensitive data is paramount to safeguarding organizational reputation, preventing financial losses, and pro-tecting individuals from identity theft. This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process, emphasizing the role of Static Application Security Testing (SAST) tools. While SAST tools play a crucial role in detecting vulnerabilities, widespread adoption has been hindered by usability issues, including high false positive rates and a lack of native pipeline support. This paper proposes a novel, generalized, and automated process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software. The process streamlines the identification and communication of security vulnerabilities during the development lifecycle, facilitating more efficient remediation efforts. We demonstrate the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment. Developers were positive about the structured implementation, real-time feedback, and proactive vulnerability management. However, despite some challenges such as a potential learning curve and tradeoffs between secure coding and workflow disruption, the overall positive impact on security awareness and responsiveness suggests that the proposed process holds promise in enhancing the security posture of software development practices
Read the full abstract ▾
Cryptography and Security
A Version Space Approach for Digital Circuit Analysis
Mitchell A. Thornton
Many questions about a digital
circuit take the same form. A hidden object is consistent with a set of observations, and one wants to know how many remain consistent and which observation to make next. The set of surviving candidates is the version space, and its size, on a logarithmic scale, measures how much the observations have settled. This paper develops the version-space view as one method and applies it to two
circuit-analysis problems usually treated as unrelated. The first is probabilistic combinational equivalence checking, where the candidates are Boolean functions and the observations are modified-Haar spectral coefficients. A method proposed in 2002 posed this counting problem and solved only two special cases, leaving the general case an enumeration exponential in the number of observations. We close it. A reparameterization onto block sums turns the dependence among nested coefficients into locality, a sum–product recursion counts the surviving functions exactly in time
polynomial in the truth-table size, closed forms follow for a single coefficient, a coefficient pair, and every ancestor-closed set, and the error of the independence approximation the 2002 work resorted to equals a computable
lattice index. Every formula is checked against exhaustive enumeration and reproduces the 2002 tables. The second application is key counting for logic-locked netlists, where the candidates are keys and the observations are oracle responses. The same recursion, run over the gate-level factor graph, computes the number of keys still consistent with a set of queries; across seventy instances of the TrustHub obfuscation release the surviving
entropy falls below the advertised key length every time. The two applications are one method: a witness supplies observations, each removes candidates, and the version space is counted exactly.
Read the full abstract ▾
Cryptography and Security
NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturing
Padmeswari Nandiya, Ahmad Mohsin, Ahmed Ibrahim et al. (+2 more)
The growing complexity of cyber-physical attack surfaces in advanced manufacturing has made cyber threat intelligence analysis increasingly difficult. Although large
language models and
retrieval-augmented generation have improved CTI workflows, text-based approaches remain vulnerable to
hallucinations and provide limited support for structured
reasoning over interconnected threats. Graph-based RAG reduces some of these limitations, but existing approaches often lack ontology-consistent multi-hop
reasoning and transparent evidence tracing across heterogeneous cybersecurity data. This paper proposes a graph-grounded neuro-symbolic framework that integrates ontology-aware symbolic query generation, knowledge graph
retrieval, and neural
language generation to support accurate and explainable threat analysis across information technology and operational technology environments. The framework adopts a dual-large
language model architecture: the first model translates natural-
language questions into executable Cypher queries for symbolic graph
retrieval, while the second generates answers strictly from the retrieved graph evidence. Experimental evaluation using publicly available cyber threat intelligence
benchmarks shows consistent improvements over the published baseline in
reasoning accuracy, while also reducing
hallucinations, strengthening multi-hop
reasoning, and improving robustness to
adversarial perturbations. Runtime and explainability analyses further demonstrate that the framework maintains interactive inference performance and exposes graph-grounded
reasoning artifacts that allow analysts to inspect and verify each stage of the analysis. Overall, the results highlight the potential of graph-grounded neuro-symbolic
reasoning as a scalable, interpretable, and reliable approach to cyber threat intelligence for next-generation Industry 5.0 environments.
Read the full abstract ▾
All authors Padmeswari Nandiya, Ahmad Mohsin, Ahmed Ibrahim, Iqbal H. Sarker, Helge Janicke