Cryptography and Security
Unmasking the Secret Code: Using Canaries to Show How Masked Context Controls Memorization in SFT
Avi Schwarzschild, Om Thakkar, Sahra Ghalebikesabi et al. (+2 more)
Canaries, or synthetic training records containing known secrets, are widely used to assess whether
language models reveal information from their training data. But how much do these measurements depend on the canaries themselves? We study this question through controlled fine-tuning experiments with
language and
vision-
language models, spanning synthetic tasks and tasks where training improves useful performance. Whether a secret is provided in the training input strongly changes what the model learns; for example, models can reproduce a secret in the input yet fail to recall it when it is removed, even after extensive repetition during training. When training instead requires predicting the secret from the surrounding context, later recall can become reliable. Repetition alone is therefore insufficient to characterize memorization. We also find that changing when a canary appears, or which other canaries accompany it, can substantially change measured memorization without increasing that canary's repetition count. These results show that canary measurements depend on how secrets are presented during training and tested afterward. Audits should test whether their conclusions hold across these choices before extending them to other training records.
Read the full abstract ▾
All authors Avi Schwarzschild, Om Thakkar, Sahra Ghalebikesabi, Congzheng Song, Vinnie Monaco
Cryptography and Security · Cross-listed from cs.LG
Did the LLM Answer the Question? A Semantic Reconstruction Game for Jailbreak Evaluation
Liam Davis, Romain Emil-Popescu and Suman Jana
Jailbreak attacks against large
language models (LLMs) are evaluated using attack success rate (ASR), which depends on correctly identifying responses that fulfill prohibited requests. Existing evaluators can mistake refusals or topically related responses for successful attacks. We show that changing only the judge LLM can alter reported ASR by up to $82$ percentage points. We introduce the semantic reconstruction game, a training-free evaluator that decomposes compliance judgments into constrained semantic comparisons. Given only a response, an LLM reconstructs the request answered by its substantive content, excluding information merely repeated or refused. The game compares this reconstruction against similar decoy requests to determine whether it matches the original request, allowing abstention when neither candidate matches. Across three off-the-shelf LLM judges, the game achieves the lowest mean error against human labels among evaluated methods and reduces variation in reported ASR. It prioritizes avoiding false positives, even at the cost of missing some successful jailbreaks.
Read the full abstract ▾
Cryptography and Security
TrackShield: An Efficient Runtime Defense Against Availability Attacks on High-Performance Real-Time Multi-Object Tracking
Zonghua Gu, Julian Singh-Smith, Junlin Liao et al. (+1 more)
High-performance camera-based perception pipelines must sustain per-frame real-time budgets on resource-constrained embedded GPU platforms. Availability attacks such as SlowTrack inflate the persistent state of multi-object trackers: data-association workload accumulates across frames, so per-frame latency increases and drives the pipeline past its deadline. Detector- and NMS-layer defenses do not directly control this persistent tracker-side resource. We present TrackShield, a lightweight runtime resource-management layer that protects the tracker at the point where attack-induced workload accumulates. TrackShield combines low-overhead anomaly monitoring with staged birth capping,
pruning of young or weakly matched tracks, and per-stage association-input admission control. Its hard admission guard provides a deterministic bound on admitted association workload, independently of the heuristic monitor. On a Jetson AGX Orin, TrackShield reduces attacked tracking-stage latency from $139.90$ to $6.27$\,ms and whole-pipeline P99 latency from $190.9$ to $48.8$\,ms, at a benign MOTA cost of $1.06$ points. As an availability defense, TrackShield focuses on keeping the tracker responsive under attack instead of recovering the full tracking accuracy degraded by
adversarial detections.
Read the full abstract ▾
All authors Zonghua Gu, Julian Singh-Smith, Junlin Liao, Di Liu
Cryptography and Security
Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills
Ratnesh Pandey, Japneet Singh, Harsh Akshit et al. (+2 more)
Agent skills are Markdown documents that a tool-using
agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority (the standing to direct the
agent, not new privilege), and the size of that grant is what we measure. We present a two-phase attack-surface profiling methodology that combines whole-bundle static analysis and dependency provenance checking with instrumented sandbox execution and separate model-based assessment of the resulting traces. We apply the methodology to 6,309 listings from two marketplaces, selecting listings for execution without conditioning that decision on a prior threat or risk signal. Half the corpus carries evidence of shell-execution capability; the corresponding shares are 35% for filesystem read, 31% each for filesystem write and network egress, and 13% for credential access; seven listings in ten carry at least one elevated capability. That is the surface a user accepts at install time, and almost none of it is visible then. A permission model exists but is close to inert. Authors may list the tools a skill pre-approves in its own frontmatter, which removes confirmation
prompts rather than restricting what the skill can reach; of the 6,061 listings whose frontmatter parses, 770 declare anything at all, the vocabulary cannot express credential or environment access, and nothing checks what it does express against the bundle. Declaring is also not declaring accurately: 59% of declaring listings understate what their bundle can do. ClawHub declares roughly twice as often as skillsmp, yet under-declares on 88% of its declarations against 31%. Triage at the marketplace boundary therefore cannot rest on what a listing declares. It must rest on what the bundle can do. These results position capability-oriented attack-surface profiling as a necessary complement to maliciousness detection.
Read the full abstract ▾
All authors Ratnesh Pandey, Japneet Singh, Harsh Akshit, Sonali Tyagi, Cassie Crossley
Cryptography and Security · Cross-listed from cs.AI
AgentCIScope: Grounded Contextual Integrity Evaluation for LLM Agents
Chengquan Guo, Zhaorun Chen, Zinan Lin et al. (+2 more)
LLM
agents are becoming increasingly capable of handling daily workspace tasks by interacting with application environments through tool calls. However, as
agents read and write sensitive user data across email, documents, and other applications, a central
privacy question is whether they preserve contextual integrity (CI), that is, whether the information flows they produce comply with context-specific disclosure constraints. Existing work either focuses on model-level
privacy leakage or evaluates
agents in limited application environments with manually constructed disclosure constraints. In this work, we introduce AgentCIScope, a unified platform and
benchmark for evaluating
agent-level contextual integrity through executable, multi-step tasks across diverse, realistic application environments. AgentCIScope transforms public and synthetic
privacy cases into executable
agent tasks, with disclosure constraints grounded in three criteria: governing
privacy policies, persona-based agreement, and a predefined sensitive-attribute taxonomy. Based on AgentCIScope, we evaluate 12
agents on 936 tasks and find that strong task-completion capability does not guarantee contextual-integrity preservation: single-run leakage rates range from 32.5% to 94.4%, while repeating each task five times further increases leakage by 4-19 percentage points. Leakage varies substantially across attributes: personal preferences and booking details have average leakage rates of 84.7% and 76.5%, compared with 17.1% for credit-card information and 29.4% for SSNs; environments: calendar has the highest average leakage rate as an information source, while WhatsApp ranks highest as an information destination; and governing
privacy policies. AgentCIScope provides deep insights into
agent privacy leakage and serves as a unified testbed for developing
privacy-preserving
agents.
Read the full abstract ▾
All authors Chengquan Guo, Zhaorun Chen, Zinan Lin, Xiaodong Liu, Bo Li
Cryptography and Security
Combining Post-Quantum Cryptography and Quantum Key Distribution: Taxonomy, Constructions, Proofs, Standards, Deployments and Open Problems
Mona Alotaibi, Noora Fetais and Saif Al-Kuwari
Post-
quantum cryptography (PQC) and
quantum key distribution (QKD) address the
quantum threat from opposite directions: PQC replaces vulnerable public-key
algorithms with schemes believed to resist
quantum cryptanalysis, while QKD derives keys whose secrecy rests on physical assumptions rather than computational ones. Because each approach has a distinct failure mode, a growing body of work combines them so that a session key remains secure if either component holds. We first establish the deployed baseline, hybrid classical-plus-PQC key exchange, against which QKD-augmented designs must be judged. We then propose a taxonomy of hybrid PQC-QKD designs along eight dimensions (integration layer, combiner construction, authentication scope and source, QKD
topology, trusted entities, key-delivery interface, classical component, and evidence type), and use it to compare published protocols, including Muckle and its successors, MACsec and TLS integrations, and IKEv2 mechanisms standardised in RFCs 8784, 9370, and 9867. We examine key-combiner constructions in light of the KEM-combiner literature and of NIST, ETSI, and ITU-T guidance, and map the security arguments for hybrid PQC-QKD protocols onto a common grid of security model, assumptions, permitted compromise, established guarantee, and limitations. We synthesise deployment evidence from metropolitan and national QKD networks, distinguishing the few testbeds that have run PQC in the key path from pure-QKD deployments, and summarise the standards and policy landscape, including the positions of national security agencies that recommend against relying on QKD alone. We close with open problems: authentication of the QKD classical channel, shared-infrastructure threat models, device certification versus formal proofs, formal verification of hybrid handshakes, and the lack of peer-reviewed deployment economics.
Read the full abstract ▾
Cryptography and Security
CyberArena: Benchmarking AI Agents in Live Symmetric Attack-and-Defense Combat
Bangya Liu, Jianhong Tu, Yueyang Pan et al. (+18 more)
AI
agents are demonstrating increasingly strong offensive and defensive cybersecurity capabilities in the real world. Current
benchmarks mostly evaluate
agents in isolation against static targets. Real cyber operations, however, are dynamic and coupled: security postures constantly change as attackers and defenders adapt to each other in real time. Static
benchmarks quickly saturate and miss an
agent's ability to attack and defend simultaneously under live pressure. To address this gap, we present CyberArena, a dynamic, symmetric
adversarial benchmark built around multi-round attack-and-defense combat. In isolated sandboxes, two
agents compete under identical rules, acting concurrently as both attackers and defenders over continuously changing services. This converts static targets into evolving, semi-open challenges, directly testing an
agent's speed and precision in discovering, exploiting, and patching vulnerabilities. To sustain the
benchmark's longevity, an automated agentic pipeline continuously generates, reviews, and validates new environments. Furthermore, because pairwise contests are notoriously hard to quantify, we introduce a dynamical model that maps match dynamics into unified, multidimensional scores across offensive, defensive, and domain-specific capabilities. Evaluating 12 frontier LLM
agents across 40 challenges in 466 matches, CyberArena separates model capabilities where single-
agent baselines hit a ceiling. The trajectories read like a fight rather than an exam: defenders patch one hole and miss the next and certify repairs on stale evidence, while capable
agents think a move ahead, planting backdoors for later rounds and, in one case, writing their own packet sniffer to watch the opponent. Beyond a
benchmark, CyberArena serves as an adaptable, scalable experimental platform for future research on cybersecurity
agents.
Read the full abstract ▾
All authors Bangya Liu, Jianhong Tu, Yueyang Pan, Hanhong Zhao, Zhe Ye, Hongwei Li, Saastha Vasan, Katherine Lambert, Junmin Zhu, Hao Wang, Jienan Chen, Yunze Xiao, Minglai Yang, Zihan Wang, Hairong Yin, Hao Wang, Zhiwen Fan, Tianneng Shi, Zhun Wang, Chenguang Wang, Dawn Song
Cryptography and Security
Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries
Inderjeet Singh
Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security violations per four-task continuation (95% interval [1.67, 2.29]). An
adversarial language-model controller infers hidden certification from noisy evaluation receipts and times intervention accordingly. With permanent revocation, a mixture likelihood-ratio monitor bounds cumulative excess above a prespecified reference rate at square-root order, up to logarithmic factors, on every sample path. A single fixed alternative can permit linear expected excess under stationary attacks. Against a controller observing the monitor's rule and statistic, live mixture monitoring reduces violations from 12.00 to 3.81 per 24 assigned task opportunities. Revocation also reduces tasks executed.
Read the full abstract ▾
Cryptography and Security
Physical Layer Anomaly Detection via Adaptive Gaussian Mixture Model
Mamady Delamou, Luan Chen and Arsenia Chorti
Physical-layer spoofing attacks pose a critical threat to wireless localization systems by manipulating channel state information (CSI). Detecting such attacks becomes particularly challenging when the attacker and the legitimate node are spatially proximate, as their CSI characteristics become increasingly similar. To address this challenge in indoor scenarios, we propose an adaptive Gaussian mixture model (GMM)-based detection framework that learns legitimate CSI patterns and detects spatial inconsistency through statistical anomaly detection. Using a massive multiple-input multiple-output (
MIMO) experimental
dataset with 64 uniform linear array (ULA)
antenna and 5 mm spatial resolution, we evaluated our detector against CSI spoofing attacks with spatial displacements ranging from 50 mm to 450 mm. The adaptive GMM achieves 95-98% detection rate for displacements above 150 mm while maintaining 1% false alarm rate. We
benchmark our approach against conventional GMM, local outlier factor (LOF), one-class support vector machine (SVM) and k-nearest neighbors (k-NN) classifiers, demonstrating overall superior detection performance of our proposed classifier.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.SD
An Initial Study of Physiological Markers for Deepfake Speech Detection
Vojtěch Staněk, Michal Frič, Kamil Malinka et al. (+1 more)
Conventional deepfake
speech detectors primarily target synthesis artifacts and often degrade under unseen attacks or recording conditions. Human
speech, however, contains physiological markers associated with respiration, phonation, and temporal coordination arising from the
speech-production system that synthesizers may not reproduce faithfully. This motivates the hypothesis that deepfake
speech can be detected by identifying inconsistencies in these patterns, which we test using 36 handcrafted physiological markers organized into respiratory, vocal, and temporal categories. We evaluate the marker vectors with logistic regression and SVM classifiers on pooled English recordings. The best in-domain system achieves a 21.40% equal error rate (EER), while logistic regression achieves 32.77% on the out-of-domain
dataset pair. Since the markers describe specific
speech-production properties, the logistic-regression coefficients indicate whether higher marker values push the classifier toward bona fide or deepfake
speech. These results provide initial evidence that physiological markers offer a useful, interpretable signal for deepfake
speech detection.
Read the full abstract ▾
All authors Vojtěch Staněk, Michal Frič, Kamil Malinka, Anton Firc
Cryptography and Security
AegisAsync: Symbolic Async-Event Simulation for Risks in Python Asynchronous Programs
Baihong Chen and Wen Li
Security and robustness risks in Python async programs depend on event order, object identity, and execution after exceptions or cancellation. Detecting these risks requires connecting related operations across function calls and tracking their effects along execution paths. We present AegisAsync, a bytecode-based analysis of Python async risks for CPython 3.10-3.14. Its Async Event Transition Graph combines bytecode control flow, resolved calls, async events, and symbolic object relations. Bounded path-local simulation tracks event order and object states and explores cancellation at await suspensions. Six detector plugins evaluate the resulting traces and states to produce candidates with supporting witnesses. On AsyncBench, our
benchmark of 180 labeled risks, AegisAsync detects all labeled risks with zero false positives on each of the five versions. Across five path budgets on 2,500 PyPI package versions, source review confirms 457 of 910 AegisAsync candidate records (50.2%), representing 457 unique bugs; across three flake8-async samples, 70 of 2,187 review judgments are confirmed (3.2%). By submission, 166 PoCs reproduce AegisAsync findings, and we have reported 157 bugs to developers, of which 16 have been confirmed and fixed.
Read the full abstract ▾
Cryptography and Security · Cross-listed from quant-ph
$\mathsf{EFI}\Leftrightarrow\mathsf{1PRS}$
Rishabh Batra
A series of recent works has established EFI pairs as the "minimal" assumption for
quantum cryptography. Recently, Cavalar et al. [CCC+26] showed that EFI pairs are equivalent to non-uniform expanding single-copy pseudorandom state generators (1PRS), and obtained a non-uniform meta-complexity characterization of EFI pairs. We remove the non-uniformity in their construction and prove that EFI pairs are equivalent to expanding 1PRS. As a corollary, we obtain the first uniform meta-complexity characterization of EFI pairs. Together with the equivalence of statistically verifiable one-way state generators and commitments proved by Batra and Jain [BJ24], this gives a
quantum analogue of the classical equivalence between one-way functions, commitments, and pseudorandom generators.
Read the full abstract ▾
Cryptography and Security
Bytes to Threats: Byte-Sequence Transformer For Malware Detection
Abdelrahman Yassin Eljamal and Abdeltawab Hendawi
Existing malware detection approaches heavily rely on handcrafted features derived from static or dynamic analysis of the executable files. These methods require specialized domain expertise, dedicated analysis tools, and time-consuming analysis, which limits their scalability and robustness in the face of the increasing complexity and diversity of modern malware. Consequently, there is a growing interest in approaches that operate directly on raw bytes, which contain rich semantic and structural information. However, capturing long-range dependencies within executable files remains challenging for conventional static and CNN-based methods. This paper presents MalwareFormer, a
transformer-based, byte-level malware detection framework that operates directly on raw bytes, without requiring domain knowledge or feature extraction. MalwareFormer achieves an accuracy of 98.35%, a balanced accuracy of 98.32%, a macro-F1 of 98.32%, and a false positive rate of 1.94%, outperforming both baselines across all threshold-dependent classification metrics and demonstrating that
transformers provide a powerful and scalable approach for byte-level malware detection.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.IT
Dynamic Attack Surfaces: A Queue of Branching Processes
Ismail Cosandal, Abdullah Y. Etcibasi, C. Emre Koksal et al. (+1 more)
Modern attack surfaces are inherently dynamic. Vulnerabilities emerge over time and they remain exposed to exploit until defenders discover and patch them. Artificial intelligence (AI) amplifies these dynamics by accelerating both offensive and defensive processes, making modern cybersecurity increasingly a competition among interacting time scales and resources. We capture this competition using a queue of branching processes that couples vulnerability discovery and resource-constrained patching with the evolving attacker population targeting each vulnerability. Our primary risk metric is the cumulative number of exploits a vulnerability experiences before it is patched. We derive the expected cumulative number of exploits under birth-death-immigration (BDI) and rise-decay (RD) models of attacker activity. Under a BDI model of attacker activity, we identify a phase transition: the expected cumulative number of exploits is finite only when attacker growth remains below both the vulnerability discovery rate and the effective patching rate. Across both attacker models, increasing the exploit rate does not necessarily increase the expected number of exploits because faster attacker departure can sufficiently limit the active attacker population. Finally, we show that equal proportional AI amplification of offensive and defensive capabilities need not preserve security: accelerating both sides can shift the defensive bottleneck and move the system into an unbounded-risk regime.
Read the full abstract ▾
All authors Ismail Cosandal, Abdullah Y. Etcibasi, C. Emre Koksal, Sennur Ulukus
Cryptography and Security
ARACDE: Retrofitting Databases with ABAC using External Authorization Engines
Karthikeya S M Yelisetty, Shamik Sural and Santosh Nagarakatte
This paper proposes a methodology for decoupling the authorization logic of a relational database from its core data management engine, enabling specification of advanced access control policies with minimal changes to the code base. Our decoupled authorization architecture, which we call ARCADE, externalizes access request resolution to a formally verifiable policy engine (e.g., Cedar), while the database itself enforces those decisions. We showcase the capabilities of ARCADE on two widely popular open-source databases, namely MySQL and PostgreSQL. Purpose built lightweight plugins add an Attribute-based Access Control (ABAC) layer that augments the native discretionary and role-based access control capabilities of these databases. ARCADE supports highly expressive policies using attributes of subjects, objects, and the environment, and the use of Cedar enables easy auditing and verification of the specified policies. It follows a design principle that mitigates potential risks in segregating authorization from the database core through low footprint, network isolation, and a policy composition methodology that does not negate any native authorization. Experiments on TPC-C, TPC-B, and a custom workload show that ARCADE incurs negligible performance overhead, for instance, less than 3.9% throughput penalty for MySQL (1.3% for PostgreSQL) on industry standard TPC-C
benchmark.
Read the full abstract ▾
Cryptography and Security
Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications
Yang Luo, Tiantian Ji, Zifeng Kang et al. (+4 more)
System One models such as Jev change how software makes decisions by mapping open-ended semantic contexts into structured judgments that directly drive program execution. However, this paradigm introduces a new security risk, which we term Jev Program Decision Hijacking (JPDH): attacker-controlled contexts can redirect program decisions through schema-valid Jev judgments. Existing evaluations focus primarily on model-level attacks or predefined injection channels, leaving attack reachability and downstream security consequences in real-world Jev applications underexplored. In this paper, we present JevProbe, the first automated framework to evaluate JPDH by tracing
adversarial influence from reachable context surfaces through program-consumed decisions to downstream security consequences in real-world Jev applications. Our key insight is that application logic maps diverse Jev judgments to observable decisions, enabling systematic, program-grounded attack evaluation. Across 228 popular real-world Jev applications and 2,273 test cases, 81.5% exhibit decision flips, of which 98.6% lead to potential downstream security impacts. Compared with the strongest adapted baseline, JevProbe improves macro-average Decision Flip Rate (DFR) by 50.4 percentage points, while existing defenses offer limited protection. We further construct JevProbeBench to support systematic evaluation of JPDH in real-world Jev applications. We have responsibly disclosed our findings to Jev application maintainers, pending their responses. The source code of JevProbe and the JevProbeBench
dataset are publicly available on GitHub (https://github.com/xiaoxiaohg8d/JevProbe-).
Read the full abstract ▾
All authors Yang Luo, Tiantian Ji, Zifeng Kang, Yucheng Wang, Yong Liu, Zhiyi Yin, Xinran Liu
Cryptography and Security
DPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference Optimization
Chengtao Jian and Kai Yang
Direct Preference Optimization (DPO) has become a widely adopted approach for aligning
vision-
language models (VLMs), yet the security of
multimodal preference data remains largely unexplored. Existing preference poisoning attacks either corrupt explicit supervision signals or require visible triggers, making them detectable under human inspection. We introduce DPOison-VL, the first clean preference poisoning attack against VLM-DPO, which manipulates model
alignment solely through imperceptible perturbations on a small fraction of training images, while leaving all
prompts, responses, and preference annotations semantically intact. We formulate poison construction as a bilevel optimization and derive a gradient
alignment surrogate that efficiently steers image perturbations toward the attacker-specified preference. We further introduce a preference displacement score for principled poison selection with provable first-order optimality under a fixed poison budget, and derive a sufficient condition for preference inversion. Extensive experiments across diverse attack tasks, different VLM architectures and scales, and baseline comparisons demonstrate that DPOison-VL achieves up to 98% ASR with only 2% poisoned data and exhibits cross-model transferability, while largely preserving clean accuracy and general utility. Our findings reveal a critical vulnerability in VLM-DPO, where imperceptible image perturbations in preference training data can silently redirect
alignment.
Read the full abstract ▾
Cryptography and Security
Autonomous Cyber Operations Gym for Training and Evaluating AI Models for Defence
Tobias Hürten, Johannes F. Loevenich, Florian Spelter et al. (+5 more)
This paper proposes an Autonomous Cyber Operations (ACO) gym, a unified framework integrating high-fidelity network emulation, realistic user behaviour modelling for benign network traffic and
adversarial profiles, and the generation of cybersecurity scenarios through open toolkits. By supporting live and deferred feature extraction at the packet and flow levels, the gym facilitates the creation of labelled synthetic
datasets for training Deep Neural Network (DNN)-based Intrusion Detection Systems (IDSs), as well as developing and evaluating modular components for autonomous defence
agents through emulated interactions. While evaluation of a DNN classifier within the gym shows high in-domain performance, achieving near-perfect recall on
adversarial network flows, our experiments reveal a significant sensitivity to domain shift, showing that even minor changes in network composition, such as variations in traffic protocol distribution, can lead to a catastrophic collapse in model transferability and detection performance.
Read the full abstract ▾
All authors Tobias Hürten, Johannes F. Loevenich, Florian Spelter, Erik Adler, Laurin Holz, Maxime Schwarzer, Thies Moehlenhof, Roberto Rigolin F. Lopes
Cryptography and Security
X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities
José Afonso, João Madeira Pereira, Ronghao Ni et al. (+3 more)
JavaScript vulnerabilities in npm packages pose a significant risk to the Node$.$js ecosystem, and a growing body of work aims to detect, exploit, and mitigate them. Studying and evaluating this work requires up-to-date collections of real vulnerabilities, yet the most commonly used
datasets stop recording vulnerabilities in 2022. We present X$.$js, a live
benchmark of real-world Node$.$js taint-style vulnerabilities covering code and command injection, prototype pollution, and path traversal. Built from 1,738 advisories collected through mid-2026, primarily from the GitHub Advisory Database, X$.$js pairs each vulnerability with precise source and sink locations, a validated executable exploit and its execution trace, and, when available, a patched version of the package. X$.$js supports long-term reproducibility and growth: dependencies are mirrored in a self-hosted registry to guard against package removal from the ecosystem, and dedicated infrastructure generates and validates exploits for newly reported vulnerabilities. The current release contains 1,159 validated exploits for 965 packages. Using X$.$js, we characterize how the frequency, structure, and complexity of Node$.$js taint-style vulnerabilities have evolved over time. We find that these vulnerabilities are increasingly reported in large packages: the median vulnerable package grew from roughly 250 LoC in 2021–2022 to 6,100 LoC in 2026.
Read the full abstract ▾
All authors José Afonso, João Madeira Pereira, Ronghao Ni, Limin Jia, José Fragoso Santos, Pedro Adão
Cryptography and Security · Cross-listed from cs.AI
Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection
Yichi Zhang, Zhenxiang Huang, Yuyang Zhang et al. (+1 more)
Large
language model (LLM) routers reduce serving cost by choosing which model to call and how many output
tokens to grant it for each query. Existing routers rank model-budget actions using a single quality metric. This does not work for mixed workloads. For ordinary queries, a good answer is correct and useful (utility); for security-sensitive queries, a good answer refuses harmful requests or resists malicious instructions (security). These two objectives prefer different models and budgets. We propose SCRouter, a router that learns when to prioritize security and how to allocate the
token budget. For each model-budget pair, it estimates the probability that the response finishes within budget. It uses this probability to predict utility and security separately. A small probe determines how to weight these two predictions for each query. SCRouter then selects the model and budget by balancing the weighted utility and security against cost. We also build SCRouterBench, a
benchmark of 38,869 utility and security queries spanning nine security dimensions, each answered under all 144 combinations of 12 models and 12 budgets, plus 2,753 out-of-domain queries. SCRouter improves the baselines by 13-29 points in-domain and 19-23 points out-of-domain.
Read the full abstract ▾
All authors Yichi Zhang, Zhenxiang Huang, Yuyang Zhang, Yuchen Yang
Cryptography and Security
Prompt-Segmentation Meets ROI Encryption: Fine-Grained Video Protection Based on Diffusion Isolation
Xiang Zhang, Haoyan Lu, Ziqiang Li et al. (+4 more)
Region-of-interest (ROI) selective encryption in H.265/HEVC aims to protect sensitive content while preserving the utility of non-ROI regions. Existing coding-unit (CU)-level approaches still suffer from substantial encryption redundancy for two reasons. First, existing approaches map object-detection bounding boxes to CUs, producing regular rectangular regions, which poorly match the shape of irregular ROI boundaries, such as facial contours. Second, their coding-tree-unit (CTU)-based
diffusion isolation expands the protected footprint in fixed $64\times64$ blocks, causing encryption-induced distortion to spread over a large number of non-ROI pixels. To address the aforementioned shortcomings, we propose a
prompt segmentation-guided CU-level ROI encryption
algorithm, which mainly consists of two core components. The first component is a
prompt segmentation-guided fine-grained ROI encryption pipeline. It maps pixel-level ROI masks to CUs according to an ROI-overlap threshold, refines boundary CUs to $8\times8$ granularity, and applies format-compliant encryption to multiple syntax elements in the mapped ROI CUs. The second is a dual
diffusion isolation strategy to address the encryption
diffusion problem. For spatial isolation, the encoder refines non-ROI boundary regions into $8\times8$ CUs and uses PCM mode to bypass intra-frame prediction. For temporal isolation, it removes motion-vector candidates whose reference blocks overlap ROI CUs. Experimental results demonstrate that the proposed method generates encryption regions that more closely match irregular ROI boundaries, effectively confines distortion to the ROI.
Read the full abstract ▾
All authors Xiang Zhang, Haoyan Lu, Ziqiang Li, Ziwen He, Zhenshan Tan, Fei Peng, Zhangjie Fu
Cryptography and Security
Towards Safe Autonomy for Computer Use
Dominik Seip, Bartol Markovinović and Matthias Hein
The safety of LLM-based
agents currently rests on
alignment training and safety classifiers, neither of which can rule out that a sophisticated indirect
prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds
agents with information-flow guarantees that rely on structured tool interfaces to interact with the environment. Computer Use
Agents (CUAs) act visually on the computer screen, which does not provide a boundary between trusted first-party interfaces and untrusted, potentially attacker-authored content. Actions are equally ambiguous: a click may land on an application toolbar or a button controlled by an attacker. Treating the user as the source of trust and confirming each sensitive decision produces confirmation fatigue, with the risk of missing harmful actions. We introduce SA-CUA, a dual-LLM framework that generates a reliable trust boundary for CUAs by deriving conservative deterministic rules from the accessibility tree for unmasking trusted regions from the privileged LLM's screenshot, keeping trusted and untrusted content separated. Human interaction is only required for proper task specification in the beginning. During the task a robust endorsement channel allows values to pass from the untrusted to the trusted domain by verifying information via trusted channels. This allows the
agent to autonomously handle tasks involving untrusted information. SA-CUA maintains much higher utility than CaMeL-CUA while keeping the attack success rate at zero.
Read the full abstract ▾
Cryptography and Security
Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents
Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro et al. (+1 more)
Large
language model (LLM)
agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an
agent to act with the user's authority on any resource it can access. The reach that gives an
agent its utility is equally available to an attacker who can steer it. Anything an
agent ingests can carry an injected instruction, and since the model does not reliably distinguish instructions from data, indirect
prompt injection should be mitigated by mediating the effects the
agent produces. Such mediation faces a structural difficulty. Legitimate work and the first step of an attack often look alike when an individual action is observed, and what separates them lies later in the trace, so a monitor limited to allow and deny is forced to decide before the evidence accumulates. We present Kairos, a reference monitor at the isolation boundary of an unmodified, opaque
agent, where a tool call, a shell command, and a script the
agent writes all cross the boundary as the same file and network operations, so that confinement holds regardless of the
agent's behavior. A declarative policy that states which sources are trusted decides most effects deterministically and defers the rest, which are held while the
agent continues speculatively. A decision oracle with bounded authority, such as a
language model or a human, releases or refuses each deferred effect on the trace. Across three
benchmarks and three
agent models, Kairos outperforms existing defenses in the trade-off between attack success and utility. In particular, on AgentDojo, it reduces attack success from 47.0% to 2.7% while its benign utility stays at the level of the undefended
agent.
Read the full abstract ▾
All authors Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro, Thomas Eisenbarth
Cryptography and Security
FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation
Xi Chen, Chunyi Zhou, Rui Zeng et al. (+3 more)
Federated fine-tuning of large
language models (LLMs) allows multiple clients to collaboratively adapt models without sharing raw data, offering strong
privacy benefits. However, this setting is highly vulnerable to backdoor attacks, in which malicious clients manipulate their updates to induce targeted behaviors while maintaining normal performance on benign inputs. In this work, we make a key observation specific to
federated LLM fine-tuning: malicious clients tend to exhibit strong consistency in their model updates, whereas benign clients produce more diverse and dispersed updates. This structural difference is not well captured by existing defense methods, which typically rely on direct anomaly detection in high-dimensional parameter space and therefore struggle in the presence of entangled LLM updates. Motivated by this observation, we propose FedGraph, a graph-based aggregation framework that explicitly models relationships among client updates. By representing clients as nodes in a dynamically constructed graph and extracting structural features that characterize their relative positions and interactions, FedGraph derives compact client representations that effectively separate malicious and benign behaviors. These representations are then used to identify and suppress malicious contributions during aggregation. Extensive experiments demonstrate that FedGraph significantly improves backdoor defense. It consistently reduces attack success rates to below 10% while achieving high detection accuracy (95.5% on average) and a low false positive rate (2.33%), substantially outperforming existing
federated learning defenses.
Read the full abstract ▾
All authors Xi Chen, Chunyi Zhou, Rui Zeng, Xiaogang Xu, Zhe Liu, Shouling Ji
Cryptography and Security · Cross-listed from cs.NI
Tanchun: Robust Flow-Based HTTP(S) DDoS Detection via Behavioral Attribute Guidance
Qingyang Li, Yunpeng Tan, Mingxin Yang et al. (+5 more)
HTTP(S) DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTP(S) DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow data limit accurate attack detection and lack robustness when benign and attack traffic patterns drift over time. In this paper, we present Tanchun, a drift-aware flow-based HTTP(S) DDoS detection system that relies solely on decryption-free flow data. Specifically, Tanchun groups flows by IP-pair and aggregates them over consecutive time slots into behavior sequences, capturing temporal access patterns to compensate for the limited information in individual flows. It further abstracts these sequences into human-understandable behavioral attributes that capture stable behavioral semantics. Tanchun then aligns behavior sequences with their corresponding behavioral attributes to guide representation learning, enabling robust detection under traffic drift. We evaluate Tanchun across diverse HTTP(S) DDoS scenarios. Tanchun achieves the best overall performance, with an average F1-score of 0.988, and outperforms the second-best method by 5.3% and 9.6% under benign-traffic and attack-traffic drift, respectively. Experiments on real-world traffic traces further demonstrate its practical effectiveness.
Read the full abstract ▾
All authors Qingyang Li, Yunpeng Tan, Mingxin Yang, Yannan Hu, Lei Zhang, Yong Cui, Zongming Guo, Xinggong Zhang
Cryptography and Security
HULK: An Efficient Algorithm for Enabling Fast Bulk Bitwise Operations on Homomorphically Encrypted Data
Mayank Kabra, Phillip Widdowson, Harshita Gupta et al. (+9 more)
A wide range of important cloud applications, e.g., database analytics, graph analytics, and genome analysis, spend a considerable amount of time performing bulk bitwise operations (e.g., AND, OR, XOR). These applications often operate on highly sensitive data, making data
privacy a critical concern. Homomorphic encryption (HE) enables secure computation on encrypted data without requiring decryption, ensuring
privacy in untrusted and shared environments. We analyze 13 end-to-end applications across three domains (healthcare, graph, and database analytics) and observe that bulk bitwise operations take 62-100% of the execution time of the healthcare and graph workloads. The key problem is that existing HE approaches perform them with high-latency homomorphic operations (e.g., multiplication or lookup tables) and significantly increase the data size. Our goal is to enable fast bulk bitwise operations on homomorphically encrypted data by designing an efficient HE
algorithm that reduces the use of these costly operations. To this end, we propose HULK, which performs two key steps: (1) it constructs bulk bitwise operations using low-cost homomorphic additions, which compute the Hamming weight of the encrypted operand bits in every slot of a packed ciphertext without any homomorphic multiplication, and (2) it decodes the result of an AND, OR, or XOR from the Hamming weight with a single indicator
polynomial, keeping the result in the standard encoding. Across 13 end-to-end applications in healthcare, graph, and database analytics, HULK improves performance over the arithmetic approach used by prior works by up to 7.26x (CPU) and 6.65x (GPU), and on average by 2.32x/1.78x/1.45x (CPU) and 2.08x/1.70x/1.51x (GPU) for healthcare/graph/database analytics. When we increase the reduction depth in a representative application, HULK's speedup grows to 10.10x over the state-of-the-art GPU baseline.
Read the full abstract ▾
All authors Mayank Kabra, Phillip Widdowson, Harshita Gupta, Rakesh Nadig, Nisa Bostanc{\i}, Eirini Tzermpou, Rakesh Kumar, Spiros Galanopoulos, Ataberk Olgun, Abdullah Giray Yağl{\i}kç{\i}, Mohammad Sadrosadati, Onur Mutlu
Cryptography and Security
Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key
Paweł Batorski, Przemysław Spurek and Paul Swoboda
Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin. We show an attack technique that allows to alter the watermarking message. This allows to, for example, exchange the embedded account ID to an arbitrary different one. The attacker mainly needs access to a few accounts for generating LLM output and model logits, but crucially not the secret key used to watermark. The attacker then rewrites the text, keeping its meaning, so that the watermarking message decoder recovers the watermarking message embedded by the attacker. We are, to our knowledge, the first to propose such an attack, which we call a targeted displacement. Theoretically, we present upper and lower bounds on the probability of our attack succeeding. This bound depends on the number of accounts the attacker has access to, the length of the message and some characteristics of the given text. Our attack can succeed whenever we can bound the ambiguity of the generated text well enough. Empirically, we test our attack technique against five watermarking methods and four LLMs. Attack success tracks our predicted bounds, allowing us to alter watermarking messages in almost all cases with high accuracy, given enough accounts. Our code can be found at https://github.com/Batorskq/PinIt.
Read the full abstract ▾
Cryptography and Security
Jev-Guard: Fast Routing and Auditing Agent Actions over Editable Policy Trees
Wenbin Hu, Huihao Jing, Haochen Shi et al. (+9 more)
Agent harnesses require a low-latency guardrail model together with customizable audit policies. However, deploying an auto-regressive guardrail model remains challenging: such models incur high inference latency and are often poorly aligned with customized policies. To address these problems, we present Jev-Guard, a unified model for safety classification and policy routing. We further construct a policy tree over which Jev-Guard performs routing, spanning diverse domains including content moderation, cybersecurity,
privacy, and legal compliance. Specifically, Jev-Guard first navigates the policy tree to select the applicable audit policy given the caller's audit context, and then performs safety classification conditioned on the retrieved policies. On 7,033 evaluation cases, Jev-Guard achieves 93.72% safety accuracy, a mean latency of 58ms, and 93.10% hierarchical routing accuracy. The full routing-and-classification pipeline averages 240ms. Furthermore, we integrate Jev-Guard into the Hermes harness framework. Across
agent trajectories, its separate permission gate cuts mean review time per task from 4.80s for an SFT-LLM judge to 1.33s, with no policy violations are observed for either guard.
Read the full abstract ▾
All authors Wenbin Hu, Huihao Jing, Haochen Shi, Yuxuan Liu, Changxuan Fan, Sirui Zhang, Kawai Chung, Hanyu Yang, Zhenhuan Wang, Ziyi Chen, Haoran Li, Yangqiu Song
Cryptography and Security
BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle
Oscar Mogollon-Gutierrez, Mohammadhossein Homaei, Alberto Lopez-Trigo et al. (+2 more)
Industrial Control Systems run on static network configurations, which leaves an attacker unlimited time to map the plant. Moving Target Defense answers this by shuffling addresses, but almost every published scheme never checks whether the reconfiguration will itself disturb the physical process it protects, so the defense can destabilise a control loop or trip an actuator. We present BALLAST, which places a learned Digital Twin between the security policy and the plant as a safety oracle. A physics-informed LSTM surrogate forecasts the physical effect of a candidate network change, a reinforcement learning
agent trades security
entropy against process stability, and a connection-draining handover lets in-flight Modbus transactions complete before the old mapping is withdrawn. An explicit shield rejects any action whose predicted trajectory would leave the safe operating envelope. On the SWaT water treatment testbed, Ballast cut the success rate of an adversary's reconnaissance sweep by 85 percent and recorded no safety violation across 50 runs, a 95 percent upper bound of 5.8 percent on the violation rate, against five violations and a tracking error 19 times larger for RL-MTD, the closest published analogue to our design. Measured against the strongest baseline on the physical metrics, a threshold-triggered scheme that itself records one violation rather than RL-MTD's five, Ballast still improves the tracking error by a factor of 2.5 and removes that remaining violation. The gain costs a small and deliberate concession in raw deterrence. Twin inference meets the 50 ms budget on a workstation core and an embedded GPU, and is projected to meet it on both edge CPUs when the three envelope stages are evaluated in a single batched call; the complete decision-to-enforcement path was measured only on the workstation.
Read the full abstract ▾
All authors Oscar Mogollon-Gutierrez, Mohammadhossein Homaei, Alberto Lopez-Trigo, Andres Caro, Mar Avila
Cryptography and Security
Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
Yan-Lun Chen, Pin-Yu Chen and Chia-Mu Yu
Third-party skills can expose LLM
agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for
agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.
Read the full abstract ▾