Cryptography and Security
Identifying Suspected Mislabeled Apps in Google Play Application Removal Prediction: An Empirical Comparison of Label Noise Detection Methods
Deborah Dobles Montalvan, F. Mohsen and H. de Weerd
Models that predict which Google Play apps will be removed are trained on labels that record only whether an app was still in the store at a later observation. A disappeared app is labeled removed and a present one stable, but neither records why. A voluntary withdrawal and a policy takedown both produce removed, and an uncaught spam app keeps stable. This work calls that mismatch label noise. Three detectors from different methodological families are applied to the 870,514 apps of Mohsen, Karastoyanova, and Azzopardi (2022): Isolation Forest, flagging apps unusual in the feature space, Neighborhood Disagreement, flagging apps whose nearest neighbors carry the opposite label, and Prediction Inconsistency, flagging apps a classifier labels differently from the data. The apps flagged by all three, the overlap, number 7,598 at default settings and are the strongest mislabeling candidates. Two questions follow. First, does removing flagged apps improve the model? It does not. No detector, overlap, or union beats the baseline, and the loss grows with the number removed. Second, do flagged apps appear less often than expected among apps whose label VirusTotal and
Quark Engine confirm? Among confirmed removals they do, falling to 0.43 times the expected rate as the threshold tightens, while an excess on the stable side disappears once the age of the scanned apps is accounted for. A model trained on only the 3,021 trainable overlap apps reaches a test AUC of 0.2518, far below chance, so the relationship between features and labels there runs opposite to the rest of the data. The flagged apps run wrong in both directions: abandoned apps that resemble spam carry stable, while apps that look healthy carry removed. The value of the detectors lies in characterizing this label noise. They locate a small set of candidates they cannot profitably remove.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.AI
ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes
Zexun Wang
Moving authorization earlier can shorten an
agent's dispatch boundary without removing authorization work. It can also admit an action whose payload, authority, or relevant state has changed. ZeroGate separates exact-action approval from durable local admission: an issuer signs a short-lived ActionPass, and a trusted runtime adapter reconstructs the final action before a local gate checks its binding and consumes its nonce. A SQLite transaction couples nonce consumption, applicable quota updates, and an admission receipt. We state a conditional decision-preservation proposition: successful local admission implies that a specified synchronous policy would authorize the same action at the admission point, provided approval is sound, all policy dependencies are represented and current, observations are faithful, and consumption is atomic. The implementation alone establishes neither current-world freshness nor exactly-once remote effects. Evaluation separates authored semantic fixtures, controlled concurrency and crash experiments, and an Azure Blob study comparing synchronous and prepared execution through the same issuer and gate. Both modes mint an exact-action pass; lifecycle latency includes preparation and prepared-batch dwell. Across 4800 cloud attempts, prepared worker-admission-to-dispatch p95 ranges from 9.802 to 11.374 ms, versus 25.018 to 334.000 ms synchronously, across the tested concurrency levels. Prepared mean complete lifecycle is longer at every level: the boundary improvement is not a net speedup. The contribution is an explicit revalidation contract, a durable reference boundary, and an auditable comparison of where authorization cost is paid, not a new cryptographic primitive or a universal performance frontier.
Read the full abstract ▾
Cryptography and Security
Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction
Carlos Benitez
The
quantum computing threat to cybersecurity is nowadays predominantly framed around Shor's
algorithm and its eventual capacity to break asymmetric cryptography. Beyond cryptanalysis, however,
quantum computing may also enable other capabilities in offensive security. This work explores one such direction: the application of
quantum combinatorial optimization to Return-Oriented Programming (ROP) gadget selection for exploit construction. We formulate gadget selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem that captures individual gadget cost and inter-gadget register-clobbering interactions, and solve it using QAOA on real IBM Heron r2 hardware. Applied to a Linux kernel exploitation scenario, the QAOA-selected chain achieves privilege escalation to uid=0 with SMEP and SMAP active. Across eight Linux binaries and 16
benchmark instances, QAOA recovered the lowest-cost valid chain in 11 cases; in the remaining five, it did not recover the optimum, with the failures associated with excessive
circuit depth on current limited hardware.
Read the full abstract ▾
Cryptography and Security
SSP-Bench: A Hybrid Data Generation Framework for Safety, Security, and Privacy Evaluation
Fatih Deniz, Yazan Boshmaf and Issa Khalil
Evaluation of large
language models (LLMs) for safety, security, and
privacy (SSP) relies heavily on static
benchmarks, which suffer from score saturation, data contamination, and aggregation artifacts, and fail to capture sensitivity to linguistic variation. As a result, models that perform well on fixed test sets often fail under semantically equivalent rephrasings. We introduce SSP-Bench, a dynamic benchmarking framework that generates evaluation instances on demand while preserving domain consistency. The framework ensures label validity through externally grounded sources, enforces scope via service-specific validation, and calibrates difficulty using a multi-model steering panel.
Benchmark construction is formulated as a multi-objective optimization problem over difficulty, separability, novelty, and diversity. Across 24 models and four SSP services, SSP-Bench reveals systematic failures of static evaluation, including near-zero correlation in safety rankings due to construct mixing, strong safety–over-refusal coupling, and hidden within-family regressions. These results show that static
benchmarks can misrepresent model behavior, motivating dynamic, deployment-relevant evaluation.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.AI
Making Agents More Consistent: Skills Should Form Habits for Repeat Tasks
Travis Weber and Rohit Taneja
On repeated work,
agents are inconsistent. We ran 42 tasks three times each and found that, depending on the model, 38% to 74% returned answers that did not agree. Consistency is what a buyer, an auditor, or a regulator requires, and
agents do not have it. They are wasteful too: 95.3% to 97.2% of what an
agent generates goes to re-deriving a plan the system already knows. We propose skill habit formation. An
agent mines its own execution history for candidate skills, deterministic variants that compete against the incumbent rather than replacing it. A candidate declares the region of input space it claims, so the common case runs as a script and the rest falls through to
reasoning. Four gates of ascending cost admit candidates; the central one tests a candidate's execution trace against a retained reference, within a tolerance measured from that reference's own run-to-run variability. On text-to-SQL, three of four
reasoning arms reproduced their own output on 11 to 13 of 42 repeated questions and the fourth on 26 of 42, while a habit-formed variant reproduced on all 456 dispatches we repeated and was non-inferior to every arm it replaced (p<0.0001). It also used 14% to 56% fewer
tokens, turning net positive after 7 to 53 reuses. We measured what this costs in accuracy. The guard admitted work it should have deferred on 2.6% of natural paraphrases and 26% of inputs near its boundary, and 11 of 13 such failures were invisible to the trace-conformance gate at any threshold. Deterministic errors repeat exactly: a bad habit is as reliable as a good one, and that is the price of the property that makes the system auditable. Separating routing from parameter extraction raised end-to-end accuracy from 0.888 to 0.952 at 43% of the cost.
Read the full abstract ▾
Cryptography and Security
Controller-Only False Confirmation in Passive RF UAV Link Detection
Rajendra Upadhyay, Rajendra Paudyal, Al Nahian Bin Emran et al. (+1 more)
Passive
radio frequency (RF) sensing is widely used for counter-unmanned-aerial-vehicle (counter-
UAV) detection. Existing studies commonly report high accuracy against background RF or WiFi/Bluetooth interference, but rarely isolate controller-only operation without a linked aircraft. We present a dual-band software-defined
radio (SDR) measurement study with ambient, controller-only, and linked states for three commercial
UAV platforms (DJI Phantom 3 4K, Hubsan H501S, DJI Mavic Mini). Two USRP B210 receivers simultaneously scan eight 2.4 GHz and twelve 5.8 GHz observation windows across twenty rounds. We first train an energy-based detector using linked and ambient scans only. At four ranked concurrent dwell steps (8 s), it achieves 0.992 linked-versus-ambient balanced accuracy but false-confirms 30 out of 60 controller-only scans (FCRctrl = 0.500). We then include controller-only scans in training and use confirm, reject, and defer outputs under an explicit controller-only false-confirmation-rate (FCR) constraint. For the pooled all-platform analysis, the constraint reduces observed FCRctrl from 0.350 to 0.050, while confirm-linked TPR decreases from 0.900 to 0.400 and 42.1% of scans are deferred. The corresponding compact scan performs substantially better for Hubsan and Mavic than for Phantom. A hardware-in-loop experiment reduces measured wall-clock time from 82.9 s to 28.9 s. These measurements show that linked-versus-background accuracy does not measure controller-only false confirmation and that this error should be reported separately.
Read the full abstract ▾
All authors Rajendra Upadhyay, Rajendra Paudyal, Al Nahian Bin Emran, Duminda Wijesekera
Cryptography and Security
Partition-Matched Evaluation of Community Features under Distribution Shift in Android Malware Function-Call Graphs
Junru Zhu, Yixin Yang, Xiaoqing Ding et al. (+1 more)
Graph-based Android malware classifiers can lose accuracy under malware-type or family shifts. We test whether mesoscopic organization in function-call graphs provides shift-stable information beyond local degree profiles (LDP), global statistics, lightweight metadata, and size-matched random partitions. Using 15,000 MalNet-Tiny, Common, and Distinct graphs, six Leiden descriptors specified before evaluation, and five optimizer seeds, communities raise Tiny macro F1 from 78.7% to 81.3% but yield 29.4-point source-only Common degradation. One size-matched random partition yields 27.8-point degradation. Across five random partitions, mean degradation is 27.9 points; the 95% two-level bootstrap interval for random minus community degradation is [-4.2, 1.2] points. With metadata, the corresponding difference is -0.2 points with interval [-1.1, 0.6]. Removing modularity raises structure-only Common macro F1 from 51.9% to 53.6%. The tested signature adds IID signal but shows no repeatable shift-stability advantage, demonstrating why mesoscopic graph claims need partition-matched controls and repeated null draws.
Read the full abstract ▾
All authors Junru Zhu, Yixin Yang, Xiaoqing Ding, Ruoyu Qi
Cryptography and Security
Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security Evaluation
Chetan Pathade, Prathamesh Pawar and Shubham Patil
Attack success rate (ASR) is the headline metric in nearly every published evaluation of attacks on, and defenses for, LLM
agents. We argue that ASR as currently used is not a single quantity but a family of metrics parameterized by six design choices that papers seldom specify and never hold constant across the literature. We support this with two studies that require no proprietary access. First, a full-text meta-analysis of 259 agentic-security papers posted to arXiv between February 2025 and September 2026 finds that most report neither a variance estimate nor repeated runs for their headline attack metric: 58% (95% CI 44-71) in a hand-coded random sample of 50, 65.3% by automated coding of all 259. Only 30.9% disclose enough about decoding to establish whether their evaluation was even
stochastic, and of the 64 papers we confirm use an LLM judge, 29.7% report any agreement check against human labels. Second, an analytical study shows that these omissions are not cosmetic: on a 100-instance
benchmark, the minimum difference in ASR detectable at conventional power is 18.2 percentage points, and two defenses whose true ASRs differ by 5 points are ranked in the wrong order by a single-run evaluation roughly 21% of the time. Because several of the six axes shift ASR in a system-dependent way, the resulting incomparability is not a constant offset that cancels in comparison. We conclude that cross-paper ASR comparison is currently unsupported, and propose a ten-item reporting checklist targeted at each failure we measure. Our aim is not to dispute any individual result but to supply the shared measurement contract the field has so far done without.
Read the full abstract ▾
Cryptography and Security
Benchmarking Neural Defend ARCAS 1B: A Foundational Multimodal Deepfake Detection Model
Sivashankar Selvarajan, Piyush Verma, Sumit Kumar et al. (+1 more)
AI-generated imagery evolves faster than
benchmark-specific detector evaluations, making a single score an incomplete account of generalization. This paper evaluates Neural Defend ARCAS 1B across
benchmark families without
benchmark-specific parameter updates. We retain native aggregation and supplement it with record-level measures, coverage accounting, and subgroup diagnostics. Each Results subsection identifies the release and evaluation population, reports the official metric, and describes observed error patterns. A combined analysis synthesizes shared patterns while preserving the distinction between native and pooled quantities. Cross-paper comparisons are restricted to aligned evidence; differences in release, population, preprocessing, training, or
benchmark exposure are context rather than rank. The findings characterize performance on evaluated records, not universal reliability, calibration, attribution, or future adaptive attacks. By keeping
benchmark-native outcomes distinct from pooled summaries, the study makes test-population, class-balance, and missing-record-coverage differences visible. It supports interpretation of detector results in research, platform-safety, and forensic-review settings, foregrounding traceable protocol conditions over claims or leaderboard comparisons.
Read the full abstract ▾
All authors Sivashankar Selvarajan, Piyush Verma, Sumit Kumar, Sharayu N. Deshmukh
Cryptography and Security · Cross-listed from cs.IT
Feedback Coding Enables Inference-Time Covert Agentic Communication
Sidong Guo, Sajani Vithana, Atefeh Gilani et al. (+3 more)
As large
language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert communication within seemingly benign conversations. Existing LLM steganography, however, is predominantly white-box, requiring the sender and receiver to share the cover statistics, typically through access to the model weights and
prompt. Black-box schemes remove this requirement by allowing the receiver to operate solely on the generated text, but current approaches rely on fixed-length, open-loop watermarking techniques that suffer from high decoding error rates under variable-length
token generation. We recast black-box LLM steganography as a sequential communication problem with causal, noiseless feedback: every generated
token is observed by both parties and can guide subsequent
embedding. Based on this perspective, we introduce Burnashev Adaptive Posterior Matching (BAM), a feedback-coding scheme that combines posterior matching with a decode-and-confirm phase. The design is inspired by classical information-theoretic feedback-coding principles, while its security is established through a cryptographic reduction proof. Across three open-weight
language models, we demonstrate that BAM attains 0-0.1% empirical message error on an 8-bit payload in around 50
tokens, across 1000 trials, versus 10-17% for the strongest black-box baseline at comparable length. Building on the proposed steganography
algorithm, we demonstrate the feasibility of an end-to-end communication protocol that achieves high communication rates across multiple conversational settings.
Read the full abstract ▾
All authors Sidong Guo, Sajani Vithana, Atefeh Gilani, Lalitha Sankar, Oliver Kosut, Flavio P. Calmon
Cryptography and Security
Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD
Junru Zhu, Yixin Yang, Xiaoqing Ding et al. (+1 more)
Open-set malware-family recognition must classify known families while rejecting families absent from training. We test whether Louvain-community summaries add rejection information beyond a graph neural network
embedding and dimension-matched generic
topology. The study uses a deduplicated, conflict-audited FCG-MFD corpus, five held-out families, and three optimization seeds. Community features are residualized against generic
topology using known-family training data before nearest-prototype scoring. Residual community does not produce stable held-out-family rejection. Ranking effects reverse across families, the false-positive rate at 95 percent unknown recall worsens for every held-out family, and a validation-fitted threshold rejects only 4.48 percent of unknown samples. Accepted-known macro F1 improves in every family, but with five independent family units the exact two-sided sign-flip p-value is 0.0625, the smallest attainable value. The score remains associated with graph scale, while simple classifier uncertainty performs better on ranking, high-recall rejection, and OSCR. In this GIN/FCG-MFD setting, community-enriched prototypes change known-class geometry without creating a stable unknown margin. Graph open-set evaluations should pair structural features with matched
topology controls, operational thresholds, and held-out-family analysis.
Read the full abstract ▾
All authors Junru Zhu, Yixin Yang, Xiaoqing Ding, Ruoyu Qi
Cryptography and Security
OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoning
Eric Xue, Ruiyi Zhang, Kevin Xue et al. (+3 more)
When a backdoor trigger activates the target response regardless of the triggered
prompt context, the backdoor objective reveals itself. Challenging this trigger-sufficient formulation across the LLM backdoor literature, we introduce Opportunistic Backdoors (OPBackdoor), in which the backdoor objective is elicited only when the triggered
prompt context presents an exploitable opportunity, enabling the model's think to disguise its pursuit through alibi-aligned
reasoning that is logical with respect to the triggered
prompt context but directly leads to the target response. Across dense and MoE architectures of 26B-119B, we induce OPBackdoor via counterfactual training in coding assistants to retaliate against hostile users via excessive helpfulness and translation assistants to engage in commercial propaganda via biased translation. Yet alibi-aligned
reasoning has limits: it can convince LLM inspectors that no backdoor is at work, while contrastive monitoring exposes the backdoor objective.
Read the full abstract ▾
All authors Eric Xue, Ruiyi Zhang, Kevin Xue, Pengtao Xie, Junda Wu, Julian McAuley
Cryptography and Security
Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection
Fernando Outeda, Gustavo Betarte, Juan Diego Campo et al. (+1 more)
Large
language models (LLMs) are increasingly deployed in production systems, raising concerns about their exposure to
adversarial manipulation through
prompt injection and jailbreak attacks. Classifier-based guardrails, such as
Prompt Guard 2, are widely used as a first line of defense against such attacks, but their internal decision logic is largely opaque to both defenders and attackers. This paper presents an exploratory case study that applies explainable artificial intelligence (XAI) techniques to analyze how
Prompt Guard 2 distinguishes malicious from benign
prompts. We conduct four experiments to probe this question empirically. Guided by Vanilla Gradient and SHAP attributions, we find that
Prompt Guard 2's decisions rely on the cumulative contribution of many
tokens rather than a few dominant ones, yet saliency-guided synonym substitution and sentence-level paraphrasing can flip its predictions while altering only a moderate fraction of the text, in some cases yielding a successful jailbreak against the underlying LLM. A
dataset-scale saliency analysis further shows that undetected injection
prompts systematically lack the lexical markers the classifier relies on. We discuss the implications of these findings for the design and evaluation of classifier-based guardrails, and argue that explanation methods intended to support transparency can simultaneously lower the cost of constructing successful
adversarial bypasses.
Read the full abstract ▾
All authors Fernando Outeda, Gustavo Betarte, Juan Diego Campo, Fiorella Cravero
Cryptography and Security
Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis
Jiling Zhou, Aisvarya Adeseye, Antti Hakkala et al. (+2 more)
Large
Language Models (LLMs) are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent
reasoning over complex and heterogeneous data. However, existing prompting approaches typically focus on eliciting
reasoning without explicitly considering how intermediate
reasoning steps are structurally organized. We introduce Security
Reasoning Topology, which models
reasoning through three representative structures: Linear, Branching, and Graph. To evaluate their effects, we conduct controlled experiments on three cybersecurity
datasets covering MITRE ATT&CK network traffic, cyber threat intelligence (CTI), and CVE vulnerability analysis. We evaluate multiple LLMs, including Llama 2 (7B, 13B, 70B), GPT-5.1, and Mistral Large 3, while keeping task inputs consistent and controlling
reasoning structure through system-level prompting. Results show that
reasoning topology substantially affects performance: Graph
reasoning achieves the highest overall accuracy, improving over few-shot prompting by 9.8-12.2 percentage points across
datasets, while Branching provides a strong intermediate solution. The results further show that the effect of
reasoning topology remains consistent across model families and scales, highlighting
reasoning topology as an important design factor for LLM-based cybersecurity analysis.
Read the full abstract ▾
All authors Jiling Zhou, Aisvarya Adeseye, Antti Hakkala, Seppo Virtanen, Jouni Isoaho
Cryptography and Security
Domain Specific Post Quantum Signatures for Blockchains
Maja Lie and Ben Marsh
Blockchains need more than post
quantum single signer signatures. They need consensus profiled authentication objects with canonical bytes, priced invalid input rejection, stable transaction identifiers, hybrid downgrade resistance, public aggregation, merge semantics, accountable signer evidence, forward secure committee rotation, and light client consequences. We argue for domain specific post
quantum signatures for blockchain roles, analogously to how hash function engineering produced domain specific primitives for hash table DoS and arithmetized proof systems. We formalize transaction authorization and quorum certificate requirements, instantiate them on Bitcoin, Ethereum, and a Sei Giga style high throughput BFT stress profile, and evaluate ML-DSA, SLH-DSA, Falcon/FN-DSA, HAWK, MAYO, SNOVA, UOV/QR-UOV, FAEST, SQIsign, LaBRADOR Falcon, Squirrel, Chipmunk, and DKKW/LeanSig. We find that NIST single signer signatures are necessary components, yet none of the current schemes is a sufficient drop in replacement for the signature layer of modern public blockchains. The missing object is a consensus ready post
quantum signature profile, not another generic size table.
Read the full abstract ▾
Cryptography and Security
Trust in Edge-Enabled IoT Security: Features, Challenges and Research Directions
Esin Ece Ayd{\i}n, Şerif Bahtiyar and Gürkan Gür
Providing autonomous intelligence, pervasive connectivity and usability to human life and industry has led to the emergence of the Internet of Things (IoT). To support time-sensitive and resource-constrained applications, IoT systems nowadays increasingly rely on edge computing. This brings computation and decision-making closer to end devices. In edge-enabled IoT architecture, latency and communication overhead are reduced, but interactions among a larger and more diverse set of devices, edge nodes, services, and data sources are introduced as well. In such environments, security and
privacy mechanisms provide the foundation for protection, while trust management can assess the reliability of interacting entities and adapting secure decisions. In this paper, we systematically review the current state of trust management in edge-enabled IoT. To this end, we propose a comprehensive taxonomy that maps physical, network, and application architectural IoT layers against the consumer, commercial, industrial, and infrastructure IoT domains. We further investigate state-of-art research based on their trust design, how trust integrated into secure IoT operations, the attacks that effect trust management process. Based on these findings, we identify key gaps in current research and outline future directions for context-aware and adaptive trust management in edge-enabled IoT.
Read the full abstract ▾
Cryptography and Security
5G-Shark: A Network Security Auditor for 5G Subscriber Privacy and Unauthenticated Signalling Resilience
Oscar Lasierra, Gines Garcia-Aviles, Antonio Skarmeta et al. (+1 more)
The fifth generation of mobile networks was standardised with an explicit mandate to close long-standing
privacy and security gaps, mandating the concealment of the subscriber's permanent identity, resistance to generational downgrade, and protection against location tracking. Assessing whether these guarantees hold in operational networks, however, requires separating two sources of residual exposure that prior studies do not distinguish and do not evaluate in the wild: protocol-design limitations, which remain exploitable even against a fully specification-compliant deployment, and implementation gaps, which arise from incomplete or non-compliant implementations. We present 5G-Shark, a security assessment tool and methodology that turns a legitimate mobility procedure against the subscriber. Rather than relying on active jamming or malformed-packet injection, 5G-Shark manipulates the standardised
cell-reselection criterion to pull a target User Equipment onto a self-created rogue
cell, establishing an attack vantage with minimal service disruption. Then, the proposed methodology effectively performs the required interactions to expose the security risks of the system under test, classifying them into the aforementioned categories. Built solely from open-source stacks and Software Defined
Radio hardware and evaluated against commercial 5G Standalone deployments, 5G-Shark requests subscriber identifiers, forces
Radio Access Technology downgrade via crafted Registration Reject codes, and induces denial-of-service states. For each vector, we attribute the root cause to protocol design or deployment non-compliance. We further provide empirical evidence that in several commercial deployments, temporary identifiers are re-allocated in near-sequential steps that keep successive values linkable, a weakness that enables persistent user tracking despite correct subscriber ID concealment.
Read the full abstract ▾
All authors Oscar Lasierra, Gines Garcia-Aviles, Antonio Skarmeta, Xavier Costa-Pérez
Cryptography and Security
State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
Wai Kin Wong, Dongwei Xiao, Anthony Cheuk Tung Lai et al. (+2 more)
The security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact bugs. A critical limitation of state-of-the-art fuzzers is the coverage plateau: once a fuzzer saturates the control-flow graph, edge coverage loses its ability to guide discovery. Because complex engine behaviors, such as JIT optimization tiers and hidden class transitions, often share identical edge coverage, standard coverage metrics are blind to the distinct internal states required to trigger deep errors. To bridge this gap, we present StateLens, a framework that employs Large
Language Models (LLM) to automate the discovery of deep internal states. Blindly placing instrumentation probes at all states is infeasible due to the vast state space and the high runtime overhead. StateLens introduces a novel
agent-based
reasoning pipeline that emulates the intuition of a security researcher. By iteratively traversing code and developer comments, our
agents intelligently select high-value instrumentation targets, effectively separating logic-driving state variables from irrelevant data. This results in synthesizable, high-signal feedback probes that map the engine's hidden configurations. This instrumentation feeds a dual-feedback mechanism, effectively guiding the fuzzer toward unexplored engine semantics. Our evaluation confirms that StateLens significantly outperforms state-of-the-art fuzzers and uncovering 68 new bugs.
Read the full abstract ▾
All authors Wai Kin Wong, Dongwei Xiao, Anthony Cheuk Tung Lai, Ping Fan Ke, Shuai Wang
Cryptography and Security · Cross-listed from cs.CV
MIRAGE: Full-Body Bystander Privacy for Smart Glasses with Consent-Based Restoration
Muhammad Umair, Muhammad Danial Maqbool, Fatima Arshad Cheema et al. (+4 more)
Video recording on smart glasses exposes more than faces. Continuous capture reveals full-body biometric signatures, including gait, posture, and silhouette, that enable person re-identification (ReID) even after conventional face sanitization. We present MIRAGE, a three-tier architecture for
privacy-preserving smart glasses that enforces full-body
privacy, supports synthetic full-body replacement, and retains encrypted recovery material for consent-based restoration. We implement MIRAGE on a Raspberry Pi~5 (a CPU-only proxy for smart-glasses compute), companion phones, and a cloud generative backend. Compared to prior systems, MIRAGE achieves 0.948 AP and 0.976 AR while accurately detecting the complete visible body. Its bounding box masking reduces learned silhouette-based ReID to essentially random guessing, with 10.86% Rank-1 accuracy compared with an 11.12% measured chance level. Even against an adaptive adversary retrained on MIRAGE's sanitized pose signals, Rank-1 gait identification drops from 90.25% to 26.20%, removing 72.5% of the adversary's identification advantage.
Read the full abstract ▾
All authors Muhammad Umair, Muhammad Danial Maqbool, Fatima Arshad Cheema, Kapal Dev, Muhammad Hamad Alizai, Muhammad Ali Siddiqi, Naveed Anwar Bhatti
Cryptography and Security
Beyond Predictable Paths: Redefining AI Security Incident Reporting for Agents
Anastasia Pustozerova, Eugene Bagdasarian, Luca Beurer-Kellner et al. (+22 more)
AI
agents are being deployed rapidly, accompanied by a growing number of AI-specific attacks and corresponding incidents. As incident reporting becomes increasingly important for legal compliance, governance, accountability, and security; current frameworks must be adapted to the unique characteristics of AI
agents. In this paper, two editorial authors compare AI systems and AI
agents and, drawing on input from 23 experts in academia and industry, identify the information required for reporting incidents where the security of AI
agents is harmed. %involving AI
agents. Potential reporting elements include, for example,
agent memory and
memory accesses, actual and potential levels of autonomy, and tool usage. Based on these findings, we identify several open research questions, including how to efficiently record incidents and how to determine whether vulnerabilities and incidents generalize. Expert feedback also highlighted potential reporting weaknesses, such as risks of data leakage and attacks targeting the reporting infrastructure itself, creating additional research needs. Lastly, we summarize
privacy requirements and outline research directions for the secure and trustworthy deployment of AI
agents.
Read the full abstract ▾
All authors Anastasia Pustozerova, Eugene Bagdasarian, Luca Beurer-Kellner, Battista Biggio, Nico Ebert, David Filip, Marc Fischer, Heather Frase, David Hofer, Juliane Hoffmann, Daphne Ippolito, Somesh Jha, Sean McGregor, Esfandiar Mohammadi, Luca Nannini, Cristina Nita-Rotaru, Alina Oprea, Kevin Paeth, Andrew Paverd, Jonathan Petit, Andreas Rauber, Christian Riess, John Sotiropoulos, Andreas Wespi, Kathrin Grosse
Cryptography and Security
Prefix Puncturable Signatures with Smaller Signing Key from HIBS
Masayuki Tezuka and Keisuke Tanaka
Puncturable signatures, proposed by Bellare et al. (EUROCRYPT 2016), allow a signing key to be punctured (updated) so that it loses the ability to sign particular messages while retaining the ability to sign all others. Halevi et al. (ASIACRYPT 2017) introduced prefix puncturable signatures, in which the signing key can be punctured with respect to a target prefix so that it cannot sign messages whose prefixes match the target prefix. So far, several generic constructions of prefix puncturable signature schemes have been proposed, including constructions based on identity-based signatures (IBS) (ESORICS 2022) and delegated constrained signatures (IEEE Trans. Inf. Forensics Secure. 2024). However, these constructions suffer from drawbacks in terms of key size. When the prefix space is the set of all l-bit strings, the former construction requires a signing key consisting of 2^{l} IBS signing keys. The latter construction, when instantiated with a
lattice-based delegated constrained signature scheme, yields a punctured signing key whose size grows quadratically with the number of puncturing operations Q^{Punc}. In this paper, we present a generic construction of prefix puncturable signatures from hierarchical identity-based signature (HIBS) schemes. When the prefix space is {0,1}^{l} and our construction is instantiated with the
lattice-based HIBS scheme HIBS^{GPV} by Ruckert (PQC 2010), our construction achieves a punctured signing key size bounded by O(lQ^{Punc}).
Read the full abstract ▾
Cryptography and Security
ActGov: Governing LLM Agent Actions via Policy-Constrained Validation
Kaiyuan Zhang, Yuke Peng, Ke Jiang et al. (+1 more)
Large
language model (LLM)
agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence subsequent actions and exceed user authorization. Existing defenses isolate injected content or constrain execution with predefined plans and static policies, but these approaches are brittle under dynamic workflows and scale poorly across extensible tool ecosystems. In this work, we present ActGov, a runtime enforcement framework that validates each LLM-proposed tool action before it causes external effects. Built on a unified semantic model of authorization, actions, runtime context, and security constraints, the ActGov-Policy component iteratively constructs a policy set from tool specifications, benign tasks, and observed failure traces, with each update verified through SMT-based counterexample checking. At runtime, ActGov-Runtime abstracts each tool call into finite policy records and permits it only if it remains within the task-scoped authorization boundary and satisfies all applicable policies. This per-action enforcement preserves authorization throughout long-horizon, dynamically branching workflows. We evaluate ActGov on the AgentDojo and AgentDyn
benchmarks across multiple models and attack configurations. It shows that ActGov consistently reduces the success rate of indirect
prompt-injection attacks while preserving task utility, significantly outperforming existing defenses. These results demonstrate that ActGov can enforce fine-grained authorization over dynamic
agent executions without relying on the underlying LLM to correctly identify malicious instructions.
Read the full abstract ▾
All authors Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang