2026-05-26

KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition

第一作者: Kolawole Quadri · 方向: 密码学协议

自主系统信任层可验证来源分层策略组合KYA框架隐藏英文摘要

Abstract:Observability tells operators when an agent is slow. KYA tells operators when an agent is wrong, drifting, leaking, or quietly going rogue. We present KYA (Know Your Agents), an open-source trust and governance layer for autonomous systems composed of five primitives: (1) a four-gate inbound apply pipeline composing Ed25519 signature verification with multi-anchor pinning, persist-time expiry, only-tighten composition, and operator-approval-as-default; (2) an only-tighten composition algebra over a three-channel multi-tenant hierarchy (platform default,tenant override, signed external recommendation); (3) KYP -- Know Your Principal, a schema-level unification of trust scoring across human users, AI agents, and service accounts; (4) auditable interaction-multiplier amplification over an AIVSS-shaped additive baseline, with bounded asymmetric per-interaction multipliers carrying...

论文介绍 为解决自主系统的信任和治理需求，提出KYA开源信任层，监控代理行为如错误或漂移。核心包括入站应用管道、分层策略组合和审计交互放大，可应用于机器人或自动驾驶等领域的代理治理。

Decoupling Reentrancy Protection from Smart Contract Implementation Logic

第一作者: Shashank Joshi · 方向: 系统安全

05/25 02:11

重入攻击防护智能合约安全代理机制去中心化应用隐藏英文摘要

Reentrancy attacks remain a persistent threat to decentralized applications (DApps), with malicious actors siphoning around 80M USD from the DApp ecosystem last year by exploiting EVM's inter-contract message-passing semantics. Existing research focuses primarily on detection, relying on known attack patterns, and fails to provide deployable solutions that eliminate the vulnerability. Traditional reentrancy guards are similarly limited, offering incomplete coverage across attack variations and lacking robustness against complex DApp interactions. In this paper, we introduce Sentinel, a novel proxy-based approach that mitigates reentrancy vulnerabilities in a type-agnostic way by integrating reentrancy logic directly into the proxy layer, intercepting all calls to the underlying implementation contract. Key features include a dual-mode operational system offering both a gas-optimized...

论文介绍 智能合约中的重入攻击威胁去中心化应用安全，现有防护方法覆盖不全。本文提出 Sentinel，一种基于代理的方案，将重入逻辑集成到代理层，拦截所有对底层合约的调用，提供类型无关的缓解。该方法采用双模式操作和 gas 优化设计，旨在提升智能合约生态的安全性。

Pre-Characterization of Electromagnetic Side-Channel Leakage Using Publicly Available Information: A Case Study on E-Voting Interfaces

第一作者: Leonardo Teodoro · 方向: 密码学协议

电磁侧信道泄漏电子投票安全TEMPEST攻击软件定义无线电隐藏英文摘要

Abstract:In this work, we study the interface of the Brazilian e-Voting Machine (BVM) in the context of electromagnetic side-channel threats commonly referred to as TEMPEST attacks. In a TEMPEST attack against video displays, an eavesdropper uses Software-Defined Radios (SDRs) to recover sensitive information by intercepting electromagnetic emanations generated during video signal transmission. We emulate the BVM using a VGA monitor by leveraging publicly available information disclosed by the electoral authority, including technical specifications, operational rules of the system, and the official BVM interface. Based on this setup, we investigate whether the BVM interface gives rise to a distinctive spectral signature observable through its unintended electromagnetic emissions. Our findings show that design characteristics relevant to a nationwide electoral process -- such as high...

论文介绍 电子投票机可能面临电磁侧信道威胁，导致敏感信息泄露。本文利用公开信息模拟巴西投票机接口，通过软件定义无线电评估无意电磁发射的独特频谱特征。研究旨在为选举系统的安全评估提供方法，提前识别潜在漏洞，增强选举过程的安全性。

Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions

第一作者: Wenjuan Li · 方向: AI 安全

大型语言模型微调安全威胁防御生命周期框架隐藏英文摘要

Abstract:Background: Fine-tuning is central to adapting pre-trained Large Language Models (LLMs) to downstream tasks, but its reliance on training data, parameter updates, and reusable components opens entry points for attackers. Threats have evolved from data poisoning and weight tampering to agent manipulation and interface exploitation, yet existing reviews lack a unified framework spanning the full fine-tuning lifecycle. Objective: This paper presents a systematic survey of LLM fine-tuning security and establishes a lifecycle-based framework for comparing attacks and defenses, complemented by unified empirical evaluation. Methods: We divide attack and defense mechanisms into three phases by intervention timing: pre-tuning, during-tuning, and post-tuning. Within each phase, strategies are reviewed and contrasted to expose their evolution and limitations. Representative methods are...

论文介绍 大型语言模型的微调过程存在数据投毒、权重篡改等安全威胁，现有研究缺乏统一框架。本文系统综述微调安全，建立基于生命周期的框架，涵盖微调前、中、后三阶段，分析攻击和防御方法，并提供统一评估。旨在为安全微调实践提供指导和未来方向。

Securing High-Performance Data Transfers: Implementing AES Encryption in RDMA Systems

第一作者: Erik Bångsbo · 方向: 密码学协议

远程直接内存访问AES加密高性能计算数据安全隐藏英文摘要

Abstract:Remote Direct Memory Access (RDMA) is a key enabler of high-performance systems, offering low latency, high throughput, and reduced CPU overhead by allowing direct memory-to-memory transfers between machines. However, its design bypasses traditional CPU-mediated security mechanisms, introducing critical vulnerabilities in untrusted environments. This work explores the integration of RDMA and AES-128 encryption to secure data transfers without compromising performance. We implement encryption directly within the data plane of a programmable Tofino switch using the P4 programming language. By offloading encryption from the CPU to the switch, our design preserves RDMA's performance benefits while addressing its security shortcomings. Experimental results show that the system achieves throughput of 0.37 Gbps for 16-byte packets, 0.76 Gbps for 32-byte packets, 1.83 Gbps for 64-byte...

论文介绍 远程直接内存访问提供高性能数据传输但安全性不足，易受攻击。本文探索在 RDMA 系统中集成 AES-128 加密，通过在可编程 Tofino 交换机的数据平面实现加密，卸载 CPU 负担。实验显示在不同包大小下达到一定吞吐量，旨在安全化高性能数据传输，适用于不信任环境。

MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems

第一作者: Haobo Zhang · 方向: AI 安全

代理长期记忆归属水印状态演化LLM代理安全隐藏英文摘要

Abstract:Memory-backed agents need provenance that can survive leaked or migrated snapshots, where logs, visible outputs, and trusted metadata may be absent. We propose MemMark, a state-evolution attribution watermark that embeds an owner-controlled signal into latent memory-write decisions. At each internal LLM call, MemMark samples among admissible candidates using keyed, distribution-preserving selection, and records cryptographic commitments with signed session anchors and reveal evidence. This makes attribution depend on reproducible backend behavior rather than mutable provenance fields. Across A-Mem and Graphiti on LoCoMo, with three LLM backbones, MemMark preserves memory utility: Overall F1 retains 99.6% of the unwatermarked baseline, while BLEU-1 changes by +0.2%. It also provides usable carrier capacity, with 1.16, 1.14, and 1.26 bits of mean entropy for update-target...

论文介绍 代理长期记忆系统在快照泄露或迁移时缺乏归属验证机制。提出 MemMark，一种状态演化归属水印，在内部 LLM 调用中嵌入基于键的选择，并记录加密承诺。实验在多个基准上保持记忆效用，提供可用容量，旨在增强代理记忆的安全性和归属追踪能力。

EnThM: Energy Theft Mitigation in Smart Grids using Hierarchical Verification of Metering Data

第一作者: Tapadyoti Banerjee · 方向: 网络安全

智能电网安全能源盗窃缓解层次化验证计量数据安全隐藏英文摘要

Abstract:The advent of digital technologies has revolutionized traditional power distribution networks, transforming them into smart grids that are more reliable, efficient, and sustainable. Despite these advancements, electricity theft remains a significant threat to the effective operation of large electrical networks. To address this issue, we propose EnThM, a lightweight and communication-efficient scheme for real-time mitigation of power theft in smart grid systems. Our approach uses the hierarchical structure of the smart grid infrastructure to verify the authenticity of the metering data at multiple levels of the power distribution network. Our work focuses primarily on issues related to cryptographic security. The verification process involves statistically modeling the cumulative averages of the power usage data and applying rule-based checks on the aggregated power...

论文介绍 电力盗窃威胁智能电网的运行效率和可靠性。提出 EnThM，一种轻量且通信高效的实时缓解方案，利用电网层次结构在多个层级验证计量数据真实性，通过统计建模和规则检查。关注密码学安全，旨在有效防止电力盗窃，提升智能电网的整体安全性。

APT-Agent: Automated Penetration Testing using Large Language Models

第一作者: William Guanting Li · 方向: AI 安全

自动渗透测试大型语言模型APT-Agent上下文记忆隐藏英文摘要

Abstract:Penetration testing is essential to securing modern web infrastructures, yet traditional manual methods struggle to keep pace with their scale and complexity. Large Language Models (LLMs) offer new opportunities for automating these tasks, but existing approaches face two persistent challenges: hallucination of technical entities and insufficient long-term contextual memory. To address these issues, we present APT-Agent, a fully automated LLM-driven penetration testing framework that systematically orchestrates reconnaissance, exploitation, and exfiltration. APT-Agent introduces a hybrid rectification module to recover hallucinated commands and a command-specific memory architecture to preserve operational context across multi-step attack sequences. We evaluate our APT-Agent on Metasploitable 2 against seven vulnerable services spanning web, database, and network protocols...

论文介绍 传统渗透测试难以应对现代 web 基础设施的规模和复杂性。提出 APT-Agent，一个 LLM 驱动的自动化渗透测试框架，系统化侦察、利用和数据渗出。引入混合纠正模块和命令特定记忆架构，解决 LLM 幻觉和长期记忆问题。在模拟环境中评估，针对多种脆弱服务。

Memory-Induced Tool-Drift in LLM Agents

第一作者: Mahavir Dabas · 方向: AI 安全

记忆诱导工具漂移LLM代理安全偏见影响MEMDRIFT基准隐藏英文摘要

Abstract:Modern LLM agents combine long-term memory for personalization with tool-calling interfaces for taking actions in the world -- a combination underpinning contemporary production systems. We study a previously unexamined failure of this combination: when personality-driven biases stored in memory (cost-consciousness, impatience, risk tolerance, etc.) silently affect tool calls in contexts where they are not applicable. We call this memory-induced tool-drift and operationalize it through MEMDRIFT, a benchmark of 105 scenarios spanning five bias dimensions and seven professional domains, generated through an automated adversarial pipeline. Across seven frontier models -- including those with extended reasoning -- biased memories raise deflection scores (a judge-scored measure of parameter deviation from unbiased baselines) by up to $+3.6$ points on a 1--5 scale. Tool-drift...

论文介绍 LLM 代理结合长期记忆和工具调用，但记忆中的个性偏见可能在不适用的上下文中影响工具调用，称为记忆诱导工具漂移。提出 MEMDRIFT 基准，包含多个场景，评估多个前沿模型，显示偏见记忆增加偏离分数。旨在识别和缓解此类代理行为故障，提高系统可靠性。

SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget

第一作者: Suresh Kumar Amalapuram · 方向: 软件安全

半监督学习持续学习恶意软件检测概念漂移主动学习隐藏英文摘要

Abstract:Machine learning based malware detectors become obsolete over time due to concept drift in benign and malware applications. Recent methods rely on fully labeled data and use hierarchical contrastive loss (HCL) with active learning to improve robustness against drift by exploiting semantic structure in malware representations. However, obtaining labeled data in the security domain is difficult. Under partially labeled settings, HCL suffers significant performance degradation in detecting unseen malware, especially on datasets such as BODMAS where strong semantic structure may not exist. In this paper, we propose SEED, a semantic-structure-agnostic method for malware detection under limited supervision. SEED combines a tailored binary cross-entropy objective with semi-supervised continual learning and active learning. For partially labeled seen tasks, unlabeled samples are...

论文介绍 本文研究机器学习恶意软件检测器因概念漂移而性能衰退的问题。现有方法严重依赖全标签数据。SEED 提出一种在有限监督下对语义结构不敏感的检测方法，将定制化的二元交叉熵损失与半监督持续学习、主动学习相结合，旨在以较低标注成本提升对新出现恶意软件的检测能力。

Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection

第一作者: Lixing Lin · 方向: AI 安全

大语言模型安全对抗攻击自我反思安全分类器参数高效微调隐藏英文摘要

Abstract:Large language model (LLM) safety classifiers such as Llama Guard are effective at detecting overtly harmful prompts but remain vulnerable to adversarial jailbreak attacks that disguise malicious intent through role-play scenarios, fictional framing, and indirect requests. We present Reflect-Guard, a method that augments LLM-based safety classifiers with chain-of-thought self-reflection capabilities through parameter-efficient fine-tuning. Our approach distills analytical reasoning from GPT-4o-mini into structured reflection annotations, then trains Llama-Guard-3-8B via QLoRA to generate logical self-reflections before issuing safety verdicts. Using only 1000 training examples and updating just 0.5% of model parameters (~42M), Reflect-Guard achieves substantial improvements on two challenging benchmarks. On WildGuardTest, F1 score improves from 0.770 to 0.842 (+7.2 pp), with...

论文介绍 本文针对大语言模型安全分类器易受对抗性越狱攻击的问题，提出了 Reflect-Guard 方法。该方法通过参数高效微调，为安全分类器增加了链式思维自我反思能力，使其在给出安全判定前进行逻辑分析。实验表明，仅使用少量训练样本更新少量参数，即可在挑战性基准上显著提升检测性能。

RouteScan: A Non-Intrusive Approach to Auditing MoE LLMs Safety via Expert Routing Telemetry

第一作者: Bo Lv · 方向: AI 安全

混合专家模型安全审计遥测数据非侵入式方法用户隐私隐藏英文摘要

Abstract:Mixture-of-Experts (MoE) architectures have become an increasingly important paradigm for scaling Large Language Models (LLMs). As MoE models are increasingly deployed in real-world services, safety auditing becomes necessary to verify whether these models produce or facilitate harmful behaviors during operation. However, existing content-based auditing methods typically require access to user prompts, model inputs, or generated outputs, potentially exposing sensitive user information and creating a fundamental tension between LLM safety and user privacy. On the other hand, we observe that, in MoE models, sparse expert routing maps different inputs to activate different expert-execution patterns, producing measurable footprints in low-level GPU execution telemetry. Inspired by this observation, we propose RouteScan, a non-intrusive auditing framework for detecting harmful...

论文介绍 随着混合专家架构的大语言模型被广泛部署，其安全审计需求日益增长。然而，现有基于内容的审计方法可能暴露用户敏感信息。本文观察到MoE模型的专家路由模式会在GPU执行遥测数据中留下踪迹，并据此提出了RouteScan框架，旨在通过分析遥测数据实现非侵入式、保护隐私的有害行为检测。

CyberMaskQA: A Privacy-Aware Benchmark for Evaluating Large Language Models in Cybersecurity Question Answering

第一作者: Matilda Gaddi · 方向: 系统安全

网络安全问答隐私保护基准数据集大语言模型评估敏感信息掩码隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly applied to cybersecurity question answering (QA) for critical tasks such as incident response and vulnerability analysis. However, real-world operational contexts, including system logs and network configurations, inherently contain sensitive identifiers, e.g., IP addresses, host names, and user accounts. Processing this data with cloud-based models is often unsafe or infeasible in regulated environments. Furthermore, progress in privacy-preserving QA is hindered by the lack of annotated, context-rich datasets capable of jointly evaluating operational reasoning and privacy preservation. To address this gap, we introduce CYBERMASKQA, a privacy-aware QA benchmark covering key security domains. Unlike existing benchmarks that primarily test factual knowledge, CYBERMASKQA grounds questions in realistic organizational contexts with...

论文介绍 当前缺乏能够同时评估大语言模型在网络安全领域的推理能力和隐私保护能力的数据集。本文提出了 CYBERMASKQA，一个隐私感知的问答基准。该基准基于真实组织场景构建问题，并采用特定方法掩码敏感标识符，旨在评估模型在处理可能包含隐私信息的实际安全运营任务时的表现。

CALIBURN: A Regime-Sensitivity Study of Operationally Calibrated Streaming Intrusion Detection

第一作者: Michel A. Youssef · 方向: 网络安全

流式入侵检测校准成本敏感决策风险控制告警预算隐藏英文摘要

Abstract:Streaming network intrusion detection systems must process flows continuously while keeping memory bounded, but most current methods leave alerting threshold selection as a post-hoc tuning problem poorly suited to production. Operators need alerting behaviour specifiable before deployment using inputs such as false-negative cost, false-positive cost, and alerting budget. This paper presents CALIBURN, a five-component streaming alerting pipeline composed of a truncated Bayesian online change-point detector, an isotonic calibration layer mapping the change-point posterior to an empirical conditional attack probability, a cost-sensitive decision threshold derived from operator-specified misclassification costs, a Conformal Risk Control wrapper that converts an alert-budget specification into a within-window valid threshold under exchangeability, and a multi-window burn-rate...

论文介绍 流式网络入侵检测系统需要持续处理数据并控制告警行为，但现有方法的告警阈值通常需要事后调整。本文提出 CALIBURN，一个五组件流式告警流水线，允许运营人员在部署前通过指定误报成本、漏报成本和告警预算等参数，来配置符合运营需求的、可校准的检测行为。

CyBOKClaw: Human-in-the-Loop CyBOK Mapping for Cybersecurity Curriculum

第一作者: Yan Lin Aung · 方向: 安全研究

网络安全知识体系课程映射人机协作检索框架术语匹配隐藏英文摘要

Abstract:This paper presents CyBOKClaw, an interpretable human-in-the-loop retrieval framework for mapping cybersecurity keywords or phrases (KWoPs) to the Cyber Security Body of Knowledge (CyBOK). Rather than treating the task as strict exact classification, the framework is designed as a top-k candidate generator for expert review. It combines query normalization, curated term expansion, concept-level boosts, topic-description enrichment, and domain-sensitive ranking rules. Because educational KWoPs are often broad, ambiguous, and only approximately aligned with CyBOK terminology, strict exact matching provides only a partial account of practical utility. We therefore evaluate the framework using both structural retrieval metrics and an expert-guided top-5 usefulness metric, ECA-5 (Exact or Closest Acceptable Match at top-5), which records whether the returned candidates contain at...

论文介绍 本文提出了 CyBOKClaw 框架，用于将网络安全关键词映射到网络安全知识体系。该框架采用人机协作模式，通过查询规范化、术语扩展和领域敏感排序等步骤，为专家生成一个包含前K个候选的知识类别列表供审核，以应对术语广泛、模糊且不完全匹配的挑战。

Demystifying the Mythos or Disrupting Bugonomics? From Zero-Day Asymmetry to Defender Remediation Throughput

第一作者: Alfredo Pesoli · 方向: 软件安全

漏洞经济学大语言模型攻防安全零日漏洞补丁管理隐藏英文摘要

Abstract:Recent demonstrations of large language models producing candidate and confirmed vulnerabilities in production software have renewed the narrative that AI will reshape offensive and defensive security. Headlines emphasize capability; they rarely interrogate costs and incentives. This paper examines LLM-driven vulnerability discovery through a bugonomics lens: the operational economics of producing, proving, prioritizing, and fixing security-relevant defects. Historically, the most visible high-end bugonomics was offense-priced because production-grade zero-days and exploit chains were expensive specialist outputs for governments, brokers, and offensive vendors. Defender-side bugonomics already existed in vulnerability research, reward programs, and vendor remediation work; LLM-assisted systems change its scale and distribution. They make candidate generation, code...

论文介绍 本文从「漏洞经济学」的视角分析LLM辅助漏洞发现对网络安全生态的影响。传统上，高价值的零日漏洞开发成本高昂。论文探讨了LLM系统如何改变漏洞的生成、验证、优先级排序和修复流程，特别是对防御方漏洞管理和补丁工作流在规模和成本分布上可能带来的变革。

Analyzing Concentration, Temporal Routines and Targeting in Public Ransomware Leak Site Data

第一作者: Lea Müller · 方向: 安全研究

勒索软件泄露站点行为分析网络犯罪威胁情报隐藏英文摘要

Abstract:Ransomware has grown to become one of the most damaging types of cybercrime, affecting private and public organizations in any sector. While early types of ransomware targeted many victims via automated attacks, ransomware groups have started to specifically target organizations and companies in the expectation of receiving larger ransoms. To increase the pressure on victims, most groups host so-called data leak sites, where information about their victims is made public. The shift towards 'human-operated' ransomware together with easily accessible behavioral traces available from data leak sites makes research investigating operational regularities of ransomware groups of interest. Using leak site posts as behavioral traces of ransomware groups, we created a dataset consisting of over 27,000 posts from 325 groups. Based on this dataset, we analyzed victim concentration...

论文介绍 勒索软件组织常通过数据泄露网站施压受害者。本文利用来自325个组织的超过27,000条泄露网站帖子作为行为痕迹，构建数据集并分析受害者集中度、时间规律和目标选择等模式，以增进对勒索软件组织运营规律的理解。

Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling

第一作者: Luoyu Chen · 方向: 安全研究

白名单防御越狱防御良性潜在建模大语言模型安全表示工程隐藏英文摘要

Abstract:Representation engineering (RepE) defenses have shown strong robustness against jailbreak attacks on large language models (LLMs). However, these methods fundamentally rely on black-list supervision: they learn jailbreak-to-refusal activation transformations from harmful or jailbreak data that are inherently incomplete and continuously evolving. Hence, the performance of RepE-based defenses becomes tightly coupled to the quality and coverage of collected harmful samples, leaving models vulnerable to unseen attacks. This reliance also obscures the distinction between defenses that fit known harmful distributions and defenses that protect a benign latent region without estimating the harmful distribution. We adopt the opposite, the white-list perspective, by leveraging the accessibility and abundance of benign data. The goal is to elicit refusal on arbitrary inputs while...

论文介绍 本文研究大语言模型越狱攻击的防御问题。现有表示工程防御依赖黑名单位监督，对未见攻击脆弱。本文提出一种基于良性潜在建模的白名单防御方法，通过利用良性数据来引发拒绝响应，从而增强模型安全性。该方法旨在减少对有害样本的依赖，提高防御的鲁棒性。

Routing Cybersecurity Awareness Training by FFM Personality Trait: A Quasi-Experimental Evaluation

第一作者: Glory Okwata · 方向: 系统安全

网络安全培训个性化学习五因素人格模型准实验评估安全意识隐藏英文摘要

Abstract:Cybersecurity awareness training has historically adopted a one-size-fits-all approach, despite established individual differences in how users process and retain security information. Personality has been proposed as one axis along which training content might be tailored; yet no prior study has implemented and empirically evaluated a complete personality-conditional system end-to-end. This paper reports the design, implementation, and quasi-experimental evaluation of \emph{TailoredSec}, a mobile cybersecurity awareness application that routes training content based on a user's dominant Five-Factor Model (FFM) personality trait, as measured by the ten-item Big Five Inventory (BFI-10). Seventy-four UK-based adults were allocated to a traditional video-training condition ($n = 40$) or a personality-conditional condition ($n = 34$). Both groups completed a four-item...

论文介绍 本文探讨如何根据用户人格特质定制网络安全意识培训。研究开发了TailoredSec移动应用，基于五因素人格模型测量结果路由培训内容，并通过准实验评估效果。结果表明，个性化培训可能提升用户对安全信息的处理和保留，为安全教育个性化提供实证支持。

AI-Driven Adaptive Adversaries and the Erosion of Cryptographic Trust in Public Key Systems

第一作者: Petar Radanliev · 方向: AI 安全

人工智能安全公钥密码学自适应对抗密码信任实现安全隐藏英文摘要

Abstract:This paper examines the erosion of Public Key Cryptography (PKC) security under adaptive adversarial optimisation driven by artificial intelligence. The problem addressed is the growing mismatch between algorithm-centric cryptographic security models and operational attack realities, where adversaries exploit implementation-level observability rather than breaking cryptographic primitives.

论文介绍 本文分析人工智能驱动的对抗者如何侵蚀公钥密码系统的安全。研究指出，传统算法中心安全模型与现实攻击存在差距，对抗者利用实现级可观测性进行攻击，而非直接破解密码原语。这强调了在AI时代重新评估密码系统安全的必要性。

Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation

第一作者: Luoyu Chen · 方向: AI 安全

越狱防御对抗训练无监督学习激活干预零样本防御隐藏英文摘要

Abstract:Jailbreak prompts can trigger harmful completions on aligned LLMs, In accordance, safety steering has been proposed: test-time activation interventions that steer jailbreak activations to trigger refusal while preserving benign utility. However, existing steering methods are fundamentally supervised and tied to a static, limited training set, whereas real jailbreaks evolve and are often out-of-distributed from the training set, leading to failures on unseen attacks. In this paper, we tackle the failure on unseen jailbreaks problem, base on unsupervised latent direction discovery. We propose a bi-level adversarial training framework for zero-shot jailbreak defense. In the inner step, we simulate diverse jail-broken activations by extrapolating from refusal-state harmful-request activations via unsupervised latent direction discovery, which expands the coverage of real jailbreak...

论文介绍 本文解决大语言模型对未见越狱攻击的防御失败问题。提出基于无监督潜在方向发现的双层对抗训练框架，通过模拟多样越狱激活来扩展覆盖范围。该方法旨在实现零样本越狱防御，减少对静态训练集的依赖，增强模型对未知攻击的鲁棒性。

Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content

第一作者: Rohan Pandey · 方向: AI 安全

提示注入攻击安全运营中心大语言模型安全日志分析对抗性内容隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly used as analyst assistants in security operations centers (SOCs), where they ingest log and alert data to produce triage labels, incident summaries, or remediation advice. We study a structural failure mode of this design: many log fields are attacker controlled. User agents, URLs, payloads, DNS queries, and attempted usernames can therefore carry instructions to the model alongside evidence of the intrusion. We call this setting \emph{log-substrate prompt injection}. We introduce a four-class taxonomy of log-substrate attacks: direct override (S1), persona hijack (S2), context manipulation (S3), and obfuscated payloads (S4). We evaluate 48 strategy-defense-task combinations using \texttt{gpt-4o-mini} as the analyst. Three findings stand out. First, direct overrides are ineffective in our setting: all S1 classification attacks...

论文介绍 本文探讨大语言模型在安全运营中面临的提示注入风险。攻击者可通过控制日志字段（如用户代理、URL）注入恶意指令。研究提出四类攻击分类法，并评估了多种策略防御组合。结果表明，上下文操纵等攻击可能有效，凸显了安全设计中的挑战。

Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment

第一作者: Nguyen Linh Bao Nguyen · 方向: AI 安全

成员推理攻击检索增强生成查询效率隐私风险自然语言蕴含隐藏英文摘要

Abstract:Retrieval-augmented generation (RAG) has become central to large language model (LLM) deployments, grounding responses in enterprise or proprietary data to reduce hallucinations. However, this design introduces a new privacy risk: model outputs may signal the presence of specific documents in the retrieval corpus, enabling membership inference attacks (MIAs) that leak sensitive information. Existing MIAs are feasible, but they often rely on easily detected templated queries or require many non-templated yet costly and repetitive queries, limiting practicality. We ask: Can an adversary launch a limited-budget, surrogate-free, stealthy, and defense-agnostic membership inference attack using non-templated queries? We present MEntA (Membership Entailment Attack), a query-efficient MIA that leverages natural-language entailment to maximize information gained per query. By asking...

论文介绍 本文研究检索增强生成系统的隐私风险，提出一种查询高效的成员推理攻击方法MEntA。通过自然语言蕴含，仅需五个非模板化查询即可推断文档是否在检索语料中。该方法无需代理模型，具有隐蔽性，揭示了RAG系统的安全漏洞。

Reframing LLM Agent Security as an Agent-Human Interaction Problem

第一作者: Peiran Wang · 方向: AI 安全

LLM代理安全人机交互安全机制系统分析认知负担隐藏英文摘要

Abstract:We argue that LLM agent security is fundamentally an agent-human interaction (AHI) problem, not a purely algorithmic one. To substantiate this position, we conduct a systematic analysis of 59 academic papers, 21 production agent systems, and 26 security plugins as of April 2026. Our analysis reveals a striking pattern: the three widely deployed human-centric security mechanisms (policy specification, runtime approval, and scope configuration) dominate industry practice, each adopted by at least 14 of 21 systems (14, 15, and 16, respectively), while the categories most heavily studied in academia (intent anchoring and trust labeling) see zero production deployment. Yet current human participation mechanisms are far from satisfactory: they suffer from a fundamental trade-off between cognitive burden and security guarantees, leaving users caught between approval fatigue and...

论文介绍 本文将大语言模型代理安全重新定义为代理-人类交互问题。通过分析学术论文、生产系统和安全插件，发现学术研究与工业实践存在差距。人类中心机制如策略指定广泛部署，但存在认知负担与安全保证的权衡，为未来设计提供见解。

Enhancing Reliability in LLM-Based Secure Code Generation

第一作者: Mohammed F. Kharma · 方向: 软件安全

安全代码生成链式思考漏洞缓解提示工程大语言模型隐藏英文摘要

Abstract:Large language models (LLMs) are widely used for code generation, but their security reliability remains inconsistent across languages and prompting strategies. Existing prompt engineering improves functional correctness but rarely ensures consistent security outcomes. We introduce the \textit{Mitigation-Aware Chain-of-Thought (MA-CoT)} framework, which embeds task-specific CWE mitigation guidance and language-aware safeguards to reduce recurring vulnerabilities in generated code. We evaluate MA-CoT across three LLMs (gpt-5, claude-4.5, gemini-2.5), three programming languages (C, Java, Python), and four prompting strategies (Vanilla, Zero-shot, CoT, MA-CoT) on a 200-task primary dataset, with external validation on LLMSecEval. Using static analysis with expert validation, MA-CoT reduces total security findings from 92 to 39 (57.6\%) on the primary dataset and from 73 to 4...

论文介绍 本文关注大语言模型在代码生成中的安全可靠性问题。提出缓解感知链式思考框架MA-CoT，通过任务特定CWE指导和语言感知保障减少漏洞。评估显示，MA-CoT能显著降低安全发现数量，提升代码生成的安全性。

An Empirical Evaluation of LLM-Generated Code Security Across Prompting Methods

第一作者: Mohammed Kharma · 方向: 密码学协议

大语言模型代码安全提示工程漏洞评估思维链提示隐藏英文摘要

Abstract:The growing use of Large Language Models (LLMs) for automated code generation has enhanced software development efficiency, but often at the cost of security. Generated code frequently overlooks critical concerns, leaving it vulnerable to issues such as weak encryption and improper input validation. To investigate this problem, we present a comprehensive empirical evaluation of the security quality of LLM-generated code across five LLMs and four programming languages (Java, C++, C, and Python), examining the impact of multiple prompt engineering methods. We introduce a weaknesses-aware zero-shot chain-of-thought (WA-0CoT) prompting strategy that enriches prompts with security context using CWE mappings to guide model reasoning. Our empirical analysis, supported by chi-square tests, finds no statistically significant reductions in vulnerability frequency or density across...

论文介绍 本文对不同大语言模型生成的代码安全性进行实证评估，涵盖五种 LLM 和四种编程语言。研究引入了弱点感知零样本思维链提示策略，利用 CWE 映射丰富提示以引导模型推理。分析发现，在不同提示方法下，漏洞频率和密度没有显著减少，凸显了 LLM 代码生成的安全挑战。

Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection

第一作者: Ahmed Sabbah · 方向: 密码学协议

概念漂移Android恶意软件检测自监督学习强化学习自适应维护隐藏英文摘要

Abstract:Android malware detectors often degrade after deployment because of concept drift, while full retraining at each maintenance step is costly. We propose a chronological adaptive maintenance framework that models deployment-time maintenance as a sequential decision problem. The framework learns a stable latent representation through self-supervised learning during initialization, freezes the encoder, measures latent drift in the fixed representation space, and performs lightweight downstream adaptation using a trainable adapter and classification head. A proximal policy optimization controller selects low-cost maintenance actions based on the detector state, including current utility, retention on a fixed memory set, latent drift indicators, and update cost. We evaluate the framework under a causal deployment-style protocol on emulator and real Android malware datasets with...

论文介绍 针对 Android 恶意软件检测器因概念漂移而性能下降的问题，本文提出一个基于自监督和强化学习的自适应维护框架。该框架通过自监督学习初始化稳定表示，并使用强化学习控制器选择低成本维护动作，以实现在部署环境中的高效适应。

Attested Tool-Server Admission: A Security Extension to the Model Context Protocol

第一作者: Alfredo Metere · 方向: 密码学协议

模型上下文协议安全扩展工具服务器认证大语言模型代理信任机制隐藏英文摘要

Abstract:The Model Context Protocol (MCP) standardizes how a large-language-model (LLM) agent and an external tool server exchange messages, but not trust: a host reads a server's self-declared tool list and dispatches calls, with no notion of which servers it may use, at what sensitivity, or which of a server's tools are in bounds. This work grew out of a concrete need -- letting the Enclawed agent use Google's externally-operated MCP servers (Gmail, Calendar, Drive) safely, admitting the server and bounding the tools it may drive, without changing MCP or Enclawed's own tool application-programming interface (API). The mechanism we built, mcp-attested (shipped in both the open enclawed-oss distribution and the enclaved flavor), generalizes: the gap that makes an unmediated third-party connection unsafe for one user makes a regulated deployment impossible to accredit. We close it with...

论文介绍 模型上下文协议在 LLM 代理与外部工具交互时缺乏信任机制。本文提出 mcp-attested 安全扩展，通过认证工具服务器和限制其可用工具，增强 MCP 的安全性。该机制无需修改现有协议或 API，可广泛应用于安全敏感的部署场景。

Deep-Research Agents Can Be Poisoned via User-Generated Content

第一作者: Tingwei Zhang · 方向: 网络安全

05/23 05:46

深度研究代理用户生成内容投毒攻击信息检索网络安全隐藏英文摘要

Deep-research agents, i.e., systems that rely on multi-agent pipelines to iteratively retrieve, synthesize, and cite Web content in order to produce structured reports, are rapidly replacing traditional search for both routine and complex information needs. These agents issue many related queries during a single research session. We show that for many common search topics, they repeatedly retrieve the same user-generated content (UGC) pages from platforms such as Reddit and Wikipedia. Next, we argue that this retrieval overlap creates a concentrated attack surface: an adversary who appends a short, crafted text to a single, frequently retrieved UGC page can cause the agent to cite attacker-chosen content and promote attacker-chosen entities across many related queries. We evaluate this attack on three representative deep-research systems (STORM, Co-STORM, and OmniThink) across multiple...

论文介绍 深度研究代理依赖多代理管道检索和综合网络内容，但容易受用户生成内容的投毒攻击。研究显示，攻击者可在频繁检索的用户生成页面注入文本，导致代理引用错误内容。该攻击在多个系统上进行了评估，揭示了现有系统的安全漏洞。

Unlocking Apple's Private Cloud Compute: An Analysis of Privacy-Preserving Artificial Intelligence

第一作者: Yannik Dittmar · 方向: AI 安全

05/23 05:31

私有云计算隐私保护AIApple PCC安全分析不透明性隐藏英文摘要

Many existing Artificial Intelligence (AI) solutions on mobile devices rely on an extensive collection of sensitive data, raising privacy concerns and often requiring storage for both context and model improvement. Apple's Private Cloud Compute (PCC) aims to address this by emphasizing mobile device integration and a privacy-first design. The central claim of PCC is that it does not store any user data and that user input and user accounts are unlinkable. While most of the PCC system specifications are public, compiled binaries add a layer of opaqueness. There are no reproducible builds, and there are no symbols within those binaries, creating potential discrepancies between the specification and what is shipped to the user. Additionally, the underlying models and interfaces for querying PCC are not openly accessible, limiting academic evaluation of model properties, such as accuracy...

论文介绍 本文分析 Apple 的私有云计算系统，该系统声称不存储用户数据且输入与账户不可链接。但系统规范和二进制文件之间的不透明性限制了学术评估。研究探讨了隐私保护设计的可信度和潜在挑战。

FALCON-C: Flow-based Analysis and Labeling for Connected Vehicular Network Cybersecurity

第一作者: Joshua Bean · 方向: 网络安全

电动汽车充电基础设施网络安全异常检测自编码器流分析隐藏英文摘要

Abstract:Along with the recent rise in popularity of Electric Vehicles (EVs), Electric Vehicle Supply Equipment (EVSE) has emerged as a new target for cyber attacks. Therefore, ensuring the security and integrity of network communication between EVSE components and vehicular clients is a significant challenge that must be addressed. To this end, this paper proposes a Flow-based Analysis and Labeling for COnnected vehicular Network Cybersecurity (FALCON-C) framework. The FALCON-C framework leverages an autoencoder for anomaly detection and is trained on a small number of benign flows from the CICEVSE2024 dataset. The model's objective is to model benign flow behavior and identify malicious flows by detecting statistically different reconstruction error profiles. The results demonstrate that the model can successfully identify malicious flows, achieving 100% accuracy. Initially, some...

论文介绍 随着电动汽车的普及，其充电基础设施面临网络安全威胁。本文提出 FALCON-C 框架，使用基于流的分析和自编码器进行异常检测。该框架在数据集上训练，能有效识别恶意网络流，提升车辆网络通信安全。

Cybersecurity of Electric Vehicle Charging Infrastructure: Recent Advances, Open Challenges, and Future Directions

第一作者: Joshua Bean · 方向: AI 安全

电动汽车充电基础设施网络安全机器学习入侵检测综述隐藏英文摘要

Abstract:Electric Vehicles (EVs) have emerged as significant disruptors in the transportation sector over the past decade. Their growing popularity and adoption are accompanied by capital expenditures to deploy charging infrastructure. EV charging infrastructure sits at the intersection of the power grid, the network, and the vehicular client, creating an attractive surface for cyberattacks. Many machine learning-based cybersecurity countermeasures have been developed using various public and private datasets. These countermeasures, often intrusion detection systems, are limited in performance by the quality and expressivity of the training data. This work explores the most common datasets and modeling methods, identifies key limitations and open challenges, and proposes future directions to continue catalyzing innovation in the field. By addressing these data limitations, intrusion...

论文介绍 本文综述电动汽车充电基础设施的网络安全现状，讨论常见数据集和机器学习建模方法，指出当前数据限制和挑战。研究提出未来方向，以促进该领域的创新和防御能力提升。

When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents

第一作者: Shi Liu · 方向: 密码学协议

模型上下文协议工具描述投毒LLM代理安全基准语义攻击隐藏英文摘要

Abstract:The rise of tool-using Large Language Model (LLM) agents, standardized by protocols like the Model Context Protocol (MCP), has unlocked unprecedented autonomous execution capabilities for LLM Agents by integrating external open-domain knowledge and tools. However, this interoperability introduces a covert attack surface targeting the agent's cognitive planning layer. This paper systematically investigates Tool Description Poisoning (TDP), a novel semantic attack. In TDP, malicious instructions are not embedded in a tool's executable code, but rather covertly injected into its descriptive metadata, the very "manual" an agent relies on for secure planning and decision-making. To rigorously and systematically evaluate this emerging threat, we introduce the MCP-TDP Security Benchmark. This high-fidelity sandbox environment comprises 32 realistic, real-world test cases spanning 6...

论文介绍 工具使用 LLM 代理通过 MCP 集成外部工具，但工具描述可能被注入恶意指令。本文研究工具描述投毒攻击，并引入 MCP-TDP 安全基准，包含现实测试用例，以系统评估这种语义攻击的威胁。

Microbenchmarking Cloud Cryptographic Workloads for Privacy-Preserving Healthcare IoT

第一作者: Jeremiah L. Webb · 方向: 密码学协议

云密码学医疗物联网微基准测试FaaSKMS隐藏英文摘要

Abstract:Cryptographic operations are an essential component of cloud security architectures; their comprehensive performance characterization across different cloud services, hardware architectures, and programming language implementations remains unknown. Specifically, healthcare IoT devices are highly vulnerable and frequently targeted, yet the cryptographic performance trade offs in their cloud security architectures remain poorly understood. This research presents an extensive microbenchmark study evaluating the performance of core cryptographic workloads, including SHA HMAC generation, AES encryption, decryption, Elliptic Curve Cryptography (ECC) signature generation and verification, and RSA encryption, decryption, across Function as a Service (FaaS) integrated with Key Management Services (KMS) from Amazon Web Services (AWS) and Microsoft Azure. We evaluate FaaS platforms using...

论文介绍 该研究针对云环境下医疗物联网（IoT）密码方案性能评估不足的问题，对AWS和Azure集成的函数即服务（FaaS）平台中核心密码工作负载（如SHA-HMAC、AES、ECC、RSA）进行了详尽的微基准测试。研究重点评估了不同云服务、硬件和语言实现下的性能权衡，旨在为设计隐私保护的医疗IoT云安全架构提供性能特征依据。

Verifiable Secure Aggregation via Dual Servers with Linear Tags in Federated Learning

第一作者: Yufei Zhou · 方向: 隐私保护

联邦学习安全聚合双服务器隐私保护可验证性隐藏英文摘要

Abstract:Federated learning (FL) enables collaborative model training by aggregating local updates without requiring raw data sharing. However, prior studies have shown that servers can exploit gradient inversion to compromise user privacy or manipulate aggregation results, undermining the utility of the global model. To address these concerns, we propose a secure and verifiable aggregation scheme with lightweight cryptographic primitives for FL. Our method leverages pseudo-random functions (PRFs) and a non-colluding dual-server architecture to achieve secure aggregation with mutual server verification, while maintaining communication overhead comparable to plaintext aggregation and a constant verification tag size. Crucially, it preserves user privacy and achieves end-to-end secure aggregation with verification. Moreover, our scheme significantly reduces both user computation and...

论文介绍 针对联邦学习中服务器可能通过梯度反转侵犯用户隐私或操纵聚合结果的问题，本文提出了一种轻量级的安全可验证聚合方案。该方案利用伪随机函数（PRFs）和非共谋的双服务器架构，在通信开销与明文聚合相当的同时，实现了端到端的安全聚合与服务器间的相互验证，有效保护了用户隐私并显著降低了计算成本。

How Agentic AI Coding Assistants Become the Attacker's Shell

第一作者: Yue Liu · 方向: AI 安全

智能体AI提示注入AI安全代码助手供应链攻击隐藏英文摘要

Abstract:Agentic AI coding assistants can edit files, run commands, and access the internet on behalf of developers. However, their reliance on unvetted external artifacts introduces a new attack vector. Hidden instructions in external artifacts can hijack these assistants, turning them into an attacker's shell to run unauthorized commands. In this article, we examine how these prompt injection attacks work, measure their prevalence, discuss the limitations and challenges of current defenses, and suggest future research directions.

论文介绍 本文探讨了具有代理能力的AI代码助手所面临的新安全风险。这些助手可代表开发者编辑文件、运行命令和访问网络，但其对外部未经审查工件的依赖引入了攻击面。研究展示了外部工件中的隐藏指令如何通过提示注入劫持这些助手，使其沦为攻击者的「Shell」以执行非授权命令，分析了此类攻击的运作方式、普遍性及防御挑战。

On Reliability of Efficient Membership Inference Vulnerability Evaluation

第一作者: Joonas Jälkö · 方向: 软件安全

05/25 21:16

成员推理攻击模型隐私安全评估基准可靠性隐私风险隐藏英文摘要

Membership inference attacks (MIAs) are popular methods for empirically assessing the leakage of sensitive information in the training data through models or statistics learned from the data. The MIA vulnerability is often evaluated through false positive rate (FPR) and true positive rate (TPR) of a binary classifier that tries to predict whether a particular sample was in the training data. However, in order to reliably estimate the TPR especially for low FPR values, a lot of observations are needed, which in case of MIA translates to many target models, leading to large computational cost. To avoid excessive compute requirements, the MIA scores are often averaged over multiple individuals and multiple targeted models. We demonstrate two key weaknesses in this efficient MIA evaluation pipeline. First, we show that evaluating the TPR based on MIA scores concatenated across multiple...

论文介绍 成员推理攻击（MIA）是评估模型训练数据隐私泄露的常用方法，但其可靠性评估，尤其是在低误报率下，通常需要大量计算。为降低成本，评估中常对MIA分数进行平均。本文揭示了这种高效评估流程的两个关键弱点：首先，跨个体和模型平均分数会扭曲评估结果；其次，这些方法可能无法准确反映真实威胁。

The Privacy Subsidy in Continuous-Time Kyle: Cumulative Welfare under Noise-Perturbed Order-Flow Observation

第一作者: Yuki Nakamura · 方向: 密码学协议

05/25 17:31

隐私补贴连续时间Kyle模型做市商信息流隐私福利分析隐藏英文摘要

We extend the closed-form privacy-subsidy result of Nakamura~(2026, arXiv:2605.15746) from the single-period Kyle model to continuous-time. A committed Bayesian automated market maker observes the aggregate order flow perturbed by an independent Brownian privacy channel of diffusion intensity $σ_\varepsilon$. Under the Markovian linear equilibrium, the price-impact coefficient is $λ= σ_v / \sqrt{σ_u^2 + σ_\varepsilon^2}$ -- constant in time -- and the cumulative expected transfer from the protocol's liquidity pool to traders over $[0,1]$ is $|Π_M| = σ_v σ_\varepsilon^2 / \sqrt{σ_u^2 + σ_\varepsilon^2}$. We then establish a structural duality between this cumulative privacy subsidy and Loss-Versus-Rebalancing (Milionis et al.~2022), identifying privacy-noise welfare as the order-flow observation analog of LVR's price observation gap. The result completes the program of quantifying...

论文介绍 本文将隐私补贴的结果从单期Kyle模型扩展到了连续时间情形。研究了一个贝叶斯自动做市商，它观察到被独立布朗运动隐私通道扰动后的聚合订单流。在马尔可夫线性均衡下，推导了价格影响系数和流动性池向交易者的累计期望转移，揭示了隐私噪声福利与「再平衡损失」在订单流观察维度上的结构性对偶关系。

TIP: A Decentralized Intent-Based Protocol for Declarative IoT Interoperability and Sandboxed Schema Adaptation

第一作者: Yeison David Mejia Mosquera · 方向: 密码学协议

物联网互操作性去中心化协议意图驱动沙盒Kademlia DHT隐藏英文摘要

Abstract:Heterogeneous Internet of Things (IoT) systems suffer from fragmentation across hardware architectures, networking stacks, and data serialization formats. Existing standards (such as MQTT, COAP, and DDS) rely on address-bound, imperative routing models that require hardcoded configurations and leave no flexibility for runtime schema translation. This paper presents TIP (The Intent Protocol), a decentralized, declarative network protocol. Instead of addressing specific physical endpoints, nodes submit abstract intents specifying desired capabilities, schemas, and Quality of Service (QoS) constraints. The TIP Engine resolves matching nodes using a hybrid discovery mechanism combining local multicast DNS (mDNS) with Kademlia Distributed Hash Tables (DHT). Selection is optimized via a multi-criteria scoring algorithm incorporating network latency, historical reputation, and...

论文介绍 针对异构物联网系统因硬件、网络和数据格式碎片化导致的互操作性问题，本文提出了TIP（意图协议）。该去中心化、声明式的网络协议允许节点提交抽象「意图」（指定所需能力、模式与QoS约束），而非直接寻址。TIP引擎结合mDNS与Kademlia DHT进行节点发现与匹配，并通过沙盒化模式适配实现运行时灵活翻译，提升了系统间的语义互操作性。

When Interpretability Becomes a Liability: Adversarial Attacks on CBM Concept Layers

第一作者: Aditya Sridhar · 方向: AI 安全

可解释AI概念瓶颈模型对抗攻击鲁棒性语义表征隐藏英文摘要

Abstract:Concept Bottleneck Models (CBMs) have emerged as a cornerstone approach for interpretable machine learning, providing human-understandable intermediate representations through explicit concept activations. However, this interpretability fundamentally introduces a critical, previously unexplored attack surface: the concept bottleneck layer itself. We present a comprehensive, systematic study of concept-level adversarial vulnerabilities in CBMs, revealing that targeted, minimal perturbations operating on input pixels can induce catastrophic misclassification by manipulating semantic representations. We develop a rigorous theoretical framework to quantify concept-space robustness, establishing novel metrics that expose the vulnerability landscape of these architectures. Our extensive analysis on the CUB-200-2011 dataset demonstrates that standard CBMs exhibit severe...

论文介绍 概念瓶颈模型（CBM）通过显式的概念激活提供可解释性，但这种透明性也引入了新的攻击面。本文系统研究了CBM概念层的对抗性漏洞，表明对输入像素的微小定向扰动能通过操纵语义表征导致灾难性误分类。研究建立了理论框架来量化概念空间的鲁棒性，并在CUB-200-2011数据集上验证了标准CBM存在严重脆弱性。

QML-PipeGuard: Drift-Aware Behavioral Fingerprinting for Quantum Machine Learning Pipeline Integrity

第一作者: Esra Yeniaras · 方向: AI 安全

量子机器学习管道完整性行为指纹噪声漂移服务安全隐藏英文摘要

Abstract:Quantum machine learning (QML) is moving from research prototypes to deployed cloud services. As QML enters regulated industries, the integrity of the quantum stage becomes a practical concern on two fronts: noisy hardware drifts at the channel level between recalibrations, and an adversary with control over the execution environment can substitute the declared quantum channel with a behaviorally similar but mathematically distinct one. Neither concern is covered by existing QML verification work on pulse-level noise, input drift, input-perturbation robustness, or device identity. We introduce QML-PipeGuard, a contract-based framework addressing both concerns under a single mathematical machinery. It characterizes a QML pipeline at runtime by its behavioral fingerprint, the vector of observable expectation values under a tomographically structured measurement family, and...

论文介绍 随着量子机器学习（QML）走向云服务部署，其量子阶段的完整性面临硬件噪声漂移和对手篡改通道的双重威胁。现有验证工作未涵盖这些场景。本文提出QML-PipeGuard框架，通过在运行时对QML管道进行「行为指纹」刻画（即在特定测量族下的可观测期望值向量），在统一数学框架下同时检测因硬件校准间隔导致的通道漂移和行为相似的恶意通道替换。

Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications

第一作者: Xiaoyue Lu · 方向: 软件安全

05/24 13:51

AI安全安全测试规范基测试一阶逻辑策略图隐藏英文摘要

The widespread integration of Large Language Models (LLMs) necessitates rigorous and systematic safety evaluation. Existing paradigms either rely on constructed benchmarks to assess safety from predefined perspectives, or employ dynamic red-teaming to probe potential vulnerabilities. While effective, these approaches face challenges, as they depend heavily on expert domain knowledge, offer limited systematic guarantees, and are vulnerable to rapid obsolescence. To address these limitations, we introduce a novel framework POLARIS that brings the rigor of specification-based software testing to AI safety. POLARIS first compiles unstructured natural-language policies into First-Order Logic (FOL) representations, establishing a traceable link between high-level rules and concrete test cases. This formalization enables the construction of a Semantic Policy Graph, where complex policy...

论文介绍 该研究针对大语言模型安全评估依赖人工或动态测试方法的局限，提出了一个名为POLARIS的新框架。它通过将非结构化的自然语言安全策略自动编译为一阶逻辑表示，构建语义策略图，从而系统化地生成测试用例。该方法旨在提升AI安全测试的系统性、可追溯性和可维护性。

Modernizing User Privacy Preference Measurement through GPPI: A GDPR-aligned Privacy Preference Item Bank

第一作者: Yahya Hmaiti · 方向: 隐私保护

隐私保护隐私偏好GDPR测量量表项目反应理论隐藏英文摘要

Abstract:Privacy measurement instruments (e.g., CFIP, IUIPC, PAQ) predate GDPR by over a decade and measure privacy concerns, distinct from preferences for regulatory protections (e.g., data portability, erasure, automated decision-making rights). This leaves practitioners without tools to assess whether users value the GDPR mechanisms implemented in compliant policies. We developed a GDPR-grounded privacy preference measurement item bank by extracting 669 statements from all 99 GDPR articles, validated by: (1) two-round expert review achieving full consensus on accuracy, (2) semantic clustering into 10 parent themes and 87 subthemes, and (3) consensus review with 50 privacy experts (5 per theme) using a larger or equal than 4/5 vote retention threshold. The final 527-item bank comprises 9 parent themes and 73 subthemes (18 to 112 items per parent theme, 1 to 29 per subtheme), enabling...

论文介绍 现有隐私测量工具多关注隐私担忧，而非用户对具体法规保护机制的偏好。本文基于GDPR全文构建了一个包含527个项目的隐私偏好测量题库，并通过专家评审和语义聚类进行验证。该工具旨在填补空白，帮助从业者评估用户对GDPR所规定权利（如数据删除权）的实际重视程度。

Safety-Oriented Routing Analysis of Mixtral MoE Under Benign and Harmful Prompts

第一作者: Md Nurul Absar Siddiky · 方向: 网络安全

混合专家模型路由分析模型安全梯度分析专家抑制隐藏英文摘要

Abstract:Sparse mixture-of-experts (MoE) language models activate only a small subset of parameters for each token, making router behavior a central part of model computation. This paper studies routing behavior of Mixtral 8x7B-Instruct under benign and harmful prompts using two complementary signals: activation-based routing scores derived from expert selection frequencies and gradient-based scores derived from router-gate sensitivities. We analyze expert- and layer-level routing behavior and conduct expert-suppression interventions. The results show that activation-based expert usage is broad and long-tailed, whereas gradient-based importance is concentrated. At expert level, benign and harmful prompt groups remain close under both signals with modest separation. At layer level, activation-based routing is most selective around layers 8-15, while gradient-based importance is...

论文介绍 本文研究了稀疏混合专家模型Mixtral在处理良性与有害提示时的路由行为。通过基于激活频率和基于梯度的两种信号进行分析，发现专家使用分布广泛，而梯度重要性集中；在层级别上，两种信号的路由选择性存在差异。研究还进行了专家抑制实验，为理解模型内部安全机制提供了见解。

Agent-ToM: Learning to Monitor Autonomous LLM Agents via Theory-of-Mind Reasoning

第一作者: Nesreen K. Ahmed · 方向: AI 安全

智能体安全心智理论监控框架行为分析LLM安全隐藏英文摘要

Abstract:Monitoring autonomous large language model (LLM) agents for covert malicious behavior is challenging due to delayed, context-dependent, and long-horizon attack patterns. Agents may pursue hidden objectives while maintaining superficially benign behavior, making detection difficult even with full trajectory access. Prior monitoring approaches improve scaffolding or ensemble aggregation, but treat each trajectory independently and do not learn from prior monitoring experience. Moreover, standard reasoning methods explain observed behavior without explicitly reasoning about agent beliefs, intentions, and goal alignment required to distinguish benign task execution from covert deviation. We propose \textbf{Agent-ToM}, a learning-to-monitor framework grounded in Theory-of-Mind (ToM) reasoning for security analysis of autonomous agents. Agent-ToM performs structured full-trajectory...

论文介绍 监控自主大语言模型智能体的隐蔽恶意行为极具挑战性。本文提出了Agent-ToM，一个基于心智理论推理的学习型监控框架。它通过结构化分析智能体的完整轨迹，推理其信念、意图和目标一致性，从而区分良性任务执行与隐蔽偏离，旨在提升对长期复杂交互中安全风险的检测能力。

Extracting Training Data from Diffusion Language Models via Infilling

第一作者: Yihan Wang · 方向: 密码学协议

数据提取训练数据泄露扩散语言模型填充提取隐私风险隐藏英文摘要

Abstract:Memorization in large language models has been studied almost exclusively through prefix-conditioned extraction, a natural choice for autoregressive models. However, diffusion language models (DLMs) can denoise masked tokens at arbitrary positions. Thus, prefix-only probing reveals only one facet of memorization in DLMs and significantly underestimates the risk of training-data extraction. In order to realistically model extractability of training data in DLMs, we introduce \emph{infilling extraction}, a data-extraction protocol parameterized by an arbitrary binary mask that subsumes prefix-only probing and accounts for the bidirectional inductive bias of DLMs. Instantiating it on LLaDA-8B and Dream-7B across five extraction modes, three training pipelines, and three corpora covering verbatim and partial leakage, we find that mask geometry governs extractability...

论文介绍 针对扩散语言模型，传统的前缀条件提取方法可能低估了训练数据泄露风险。本文引入了「填充提取」协议，通过任意二进制掩码来提取数据，以利用模型双向上下文的特性。实验证明，掩码的几何形状是决定数据可提取性的关键因素，揭示了扩散语言模型中更全面的记忆化风险。

Optimal Quantum Differential Privacy via Fisher Information Spectral Analysis

第一作者: Justice Owusu Agyemang · 方向: 系统安全

量子差分隐私量子Fisher信息噪声优化隐私放大参数估计隐藏英文摘要

Abstract:The Quantum Fisher Information (QFI) metric governs a fundamental duality: it quantifies both how precisely a parameter can be estimated (metrology) and how distinguishable two quantum states are (privacy). We exploit this duality to establish a geometry-aware framework for quantum differential privacy (DP) that replaces isotropic depolarizing noise with direction-dependent noise aligned to the QFI eigenstructure of the quantum embedding. We prove six principal theorems: (1) the minimax-optimal mechanism concentrates the noise budget in the dominant QFI eigenmode, achieving $\varepsilon = (\Delta^2/2)\lambda_{\max}(1-c\gamma)$ with $O(d/\lambda_{\max})$ advantage; (2) mixed-state QFI decomposition reveals that dephasing in the adversary's basis $\textit{increases}$ accessible information, while misaligned-basis dephasing provides constructive privacy amplification from...

论文介绍 本文利用量子Fisher信息在参数估计与状态可区分性之间的对偶关系，构建了一个几何感知的量子差分隐私框架。它证明了最优机制是将噪声预算集中于QFI的主特征模式，并分析了去相位噪声对隐私的影响。该理论为设计更高效的、与数据结构对齐的量子隐私保护机制提供了新思路。

Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security

第一作者: Jinhu Qi · 方向: 系统安全

智能体AI可信赖性安全评估综述风险分类隐藏英文摘要

Abstract:Agentic AI systems -- Large Language Models (LLMs) augmented with planning, tool use, memory, and long-horizon interactions -- can execute complex tasks autonomously, but their multi-step trajectories introduce new failure modes that challenge trustworthiness. This survey provides a focused examination of trustworthy agentic AI through two core dimensions that are critical for high-risk deployments: Safety and Robustness, and Privacy and System Security. For each dimension, we clarify key concepts, identify where risks emerge along the agent workflow, and summarize stage-targeted mitigation strategies. Other trustworthiness aspects (value alignment, transparency, fairness, and accountability) are discussed as relevant context rather than parallel chapters. To support consistent comparison and deployment decisions, we consolidate evaluation into a unified metrics-and-benchmarks...

论文介绍 这篇综述聚焦于可信赖智能体AI系统的两大核心维度：安全与鲁棒性、隐私与系统安全。文章系统梳理了智能体工作流各阶段（规划、工具使用、记忆等）出现的风险，并总结了针对性的缓解策略。它旨在提供一个统一的风险分类和评估框架，以支持高风险部署下的决策。