2026-05-27

Control Physiology: An Agent-Based Model of FAIR-CAM Dynamics

第一作者: Jack Jones · 方向: 安全研究

05/26 14:31

FAIR-CAM控制有效性代理模型风险分析安全控制隐藏英文摘要

Security risk analysis typically treats control effectiveness as a static input, yet controls degrade through configuration drift, depend on monitoring systems that may themselves be degraded, and compete for finite remediation budgets. The FAIR Controls Analytics Model (FAIR-CAM) provides the theoretical framework for these dynamics but has so far remained theoretical. We present the first agent-based model to operationalize the core FAIR-CAM dynamics, making control physiology computationally observable, and release the implementation as open source. The simulation implements eight agent types, a multiplicative defense-in-depth susceptibility formula, a three-source variance model, budget-constrained remediation, and a narrative causation engine that produces a complete causal trace for every loss event. In a hospital ransomware scenario (N=1,000 iterations), three organizational...

论文介绍 安全风险分析通常将控制有效性视为静态输入，而实际上控制会因配置漂移而退化。FAIR控制分析模型（FAIR-CAM）提供了相关动态的理论框架，但此前未被操作化。本文提出了首个代理模型来实现FAIR-CAM的核心动态，使控制的“生理”变化变得可计算观测。该模型在勒索软件场景仿真中展示了组织因素对风险的影响，并开源了实现。

Cordyceps: Covert Control Attacks on LLMs via Data Poisoning

第一作者: Zedian Shao · 方向: AI 安全

数据投毒隐蔽控制攻击大型语言模型AI安全信息隐藏隐藏英文摘要

Abstract:Large language models (LLMs) are often fine-tuned on uncurated text datasets that adversaries can poison. Existing poisoning attacks primarily rely on fixed trigger phrases that defenses such as outlier detection, clean-data regularization, or online monitoring can neutralize. In this paper, we propose a data poisoning method that teaches an LLM an information hiding scheme reliably and stealthily through semantic associations between shared knowledge such as facts or concepts and attacker-chosen phrases. The induced hiding scheme can encode and decode arbitrary malicious instructions, thus revealing a new and subtle poisoning-induced vulnerability: covert control attacks. We precisely characterize covert control attacks and evaluate them across $5$ LLMs, $3$ backdoor defenses, and $4$ prompt injection defenses. With a small poisoned fraction, covert control attacks outperform...

论文介绍 针对大型语言模型微调数据可能被投毒的问题，本文提出一种通过语义关联实现隐蔽控制的新攻击方法「Cordyceps」。该方法使模型学会一种信息隐藏方案，可编码和解码任意恶意指令。评估表明，该攻击在多种后门防御和提示注入防御下依然有效，揭示了数据投毒导致的一种新型、微妙的安全漏洞。

GradSentry: Gradient Spectral Entropy for Backdoor Sample Filtering in Large Language Model Fine-Tuning

第一作者: Haodong Zhao · 方向: AI 安全

后门攻击梯度谱熵样本过滤大型语言模型AI安全隐藏英文摘要

Abstract:Fine-tuning Large Language Models with untrusted data exposes models to backdoor attacks, where poisoned samples cause targeted misbehavior. Existing sample-filtering defenses rely on clustering, which requires sufficient data and can fail at extreme poison ratios. We propose GradSentry ({Grad}ient {Sentry}), a backdoor sample filtering method based on the spectral entropy of per-sample gradients. Our key finding is that poisoned samples produce gradients with higher spectral entropy compared to clean samples. GradSentry captures output-altering backdoor signatures using per-sample gradient spectra, avoiding pairwise sample comparisons and clustering during feature construction. Importantly, our method is training-agnostic: it works for both parameter-efficient fine-tuning methods like LoRA and full-parameter tuning, as the gradient analysis operates independently of which...

论文介绍 针对大模型微调中利用有毒数据注入后门的安全问题，本文提出GradSentry防御方法。其核心发现是，有毒样本的梯度谱熵高于干净样本。基于此，该方法利用逐样本梯度谱进行特征构建和过滤，避免了聚类需求，且适用于LoRA等参数高效微调，为模型安全提供了一种新的、与训练无关的防御思路。

SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?

第一作者: Hwiwon Lee · 方向: 软件安全

05/26 12:59

软件安全漏洞发现基准测试语言模型长时程任务隐藏英文摘要

Large language models (LLMs) now support automated software security tasks, including vulnerability discovery and proof-of-concept (PoC) generation. Existing benchmarks do not faithfully evaluate LLMs in real-world bug hunting scenarios because they rely on fuzzing harnesses, target-specific descriptions, or vulnerability-reproduction tasks. We present SEC-bench Pro, a benchmark for measuring agent bug hunting on critical, high-complexity software systems. This work discloses reports with concrete PoC inputs and links fixes into reproducible tasks through a three-phase pipeline for vulnerability collection, environment reconstruction, and oracle-based validation. We instantiate SEC-bench Pro with 183 validated vulnerabilities across V8 and SpiderMonkey, including a V8 subset with more than $1.5 million in cumulative Google Vulnerability Reward Program awards. These instances span...

论文介绍 针对现有基准测试无法真实评估语言模型在复杂软件系统中执行安全任务能力的问题，本文提出SEC-bench Pro基准。该基准通过三阶段流程收集并验证V8和SpiderMonkey等关键系统中的高复杂度漏洞，构建了183个可复现的任务实例。它旨在衡量语言模型智能体进行长期漏洞发现与利用的能力，推动自动化软件安全研究。

ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation

第一作者: Xiaochong Jiang · 方向: 软件安全

工具使用智能体安全组合能力衰减运行时防护权限管理隐藏英文摘要

Abstract:Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five...

论文介绍 针对工具使用智能体在运行时组合多种工具可能产生不安全端到端效果的「权限洗白」问题，本文提出ChainCaps框架。该框架为每个数据值关联一个能力预算，并通过交集传播确保权限在工具链中只能保留或丧失，而不能通过组合新增。ChainCaps作为透明代理实现，无需修改智能体或工具服务器，有效增强了开放环境中的组合安全性。

Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents

第一作者: Peiran Wang · 方向: 软件安全

LLM代理间接提示注入授权安全双图对齐工具调用隐藏英文摘要

Abstract:LLM-based agents are increasingly deployed in high-stakes scenarios such as email management, financial transactions, and code execution, where they interact with the external world through tool calling. During execution, these agents must read external data sources (emails, webpages, files) that attackers can control; through indirect prompt injection, attackers embed malicious instructions in this data to manipulate agents into performing unauthorized operations such as transferring funds to attacker-controlled accounts. Existing defenses either perform tool-call-level value checking without tracking where parameter values originate, or analyze execution traces from a single perspective without a clean authorization baseline for comparison. We propose AuthGraph, a dual-graph alignment defense framework that constructs two complementary graphs: an injected reasoning graph...

论文介绍 针对LLM代理在调用工具时可能因数据源被注入恶意指令而执行未授权操作的问题，本文提出AuthGraph双图对齐防御框架。该框架同时构建记录参数值来源的「推理图」和定义合法操作的「授权图」，并通过对齐来验证操作是否授权。这有助于追踪值的起源并确保符合授权策略，从而防御间接提示注入攻击，提升代理在关键场景中的安全性。

Beyond Epsilon: A Principled QIF Framework for Local Differential Privacy

第一作者: Ramon G. Gonze · 方向: 隐私保护

05/26 10:20

本地差分隐私定量信息流隐私分析频率估计隐私评估隐藏英文摘要

Local Differential Privacy (LDP) has become the de facto standard for privacy-preserving data collection in large-scale systems, in particular for the purpose of estimating frequencies. However, the current research landscape lacks a systematic and principled way to compare LDP protocols. The parameter $\varepsilon$ of LDP is considered the measure of privacy, but it only bounds worst-case distinguishability. Other comparisons rely on utility-driven analyses, where mechanisms are ranked based on their ability to preserve data utility for a given privacy budget $\varepsilon$. Both such kinds of comparisons fail to account for the strength of protocols against diverse attacker models. In this paper, we propose a framework for analyzing LDP frequency estimation protocols through the lens of Quantitative Information Flow (QIF). By modeling LDP mechanisms as probabilistic channels, we...

论文介绍 本文指出仅依赖隐私参数ε来比较本地差分隐私协议存在局限，因其仅约束最坏情况区分度。为此，作者提出一个基于定量信息流的分析框架，将LDP机制建模为概率信道。该框架能够更系统、更原则地评估不同LDP频率估计协议在对抗多种攻击者模型时的隐私强度，为隐私保护数据收集协议的设计与比较提供了新视角。

Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models

第一作者: Hayden Helm · 方向: 系统安全

越狱攻击行为几何易感性预测防御转移生成系统隐藏英文摘要

Abstract:Evaluating and mitigating a generative system's susceptibility to jailbreak attacks is critical to its safe deployment. Given the number of deployable systems, full per-configuration evaluation and optimization is impractical. In this paper, we formalize the behavioral geometry of a population of models that, by leveraging previously evaluated and defended models, supports both efficient susceptibility prediction and effective defense transfer across a population. We apply the framework to 79 models spanning 24 providers and to 100 system configurations of a single base model. Simple methods that use the behavioral geometry reach an AUPRC of $0.94$ for susceptibility detection with $\approx98\%$ fewer probes relative to a full evaluation. Using the behavioral geometry to select which model to transfer an optimized defense from outperforms same-provider assignment ($+2\%$, $p =...

论文介绍 针对全面评估和优化生成系统对越狱攻击易感性成本高昂的问题，本文提出利用模型群体的行为几何特性。该框架通过建模已评估模型的行为关联性，支持仅使用少量探针高效预测新模型的易感性，并能有效将经过优化的防御措施从一个模型转移到其他模型，显著降低了安全评估和防护部署的开销。

Context-Aware Metric Differential Privacy for Vehicle Trajectory Data

第一作者: Gaoyi Chen · 方向: 隐私保护

05/26 05:54

车辆轨迹数据度量差分隐私上下文感知位置隐私数据效用隐藏英文摘要

Metric Differential Privacy (mDP) generalizes differential privacy by allowing privacy guarantees to be expressed with respect to an arbitrary distance metric over secrets. While mDP has been adopted in geo-location protection, most existing mechanisms perturb each location record in isolation and do not model how contextual information (e.g., recent mobility history) affects the utility of the released data. This mismatch is particularly pronounced for vehicle mobility traces, where service quality often depends on temporally correlated locations. In this paper, we propose Context-aware mDP (C-mDP), a framework for vehicle location privacy that incorporates contextual dependencies into both the utility model and the privacy notion. C-mDP treats the protected secret as a context-augmented record and enforces metric indistinguishability over this augmented domain. We formulate optimal...

论文介绍 针对车辆轨迹数据发布中，现有度量差分隐私机制忽略上下文信息（如移动历史）导致数据效用降低的问题，本文提出C-mDP框架。该框架将上下文依赖同时纳入隐私定义和效用模型，通过处理增强的「上下文增强记录」来确保度量不可区分性。它在为车辆位置提供强隐私保证的同时，更好地保留了数据的服务质量和实用性。

Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models

第一作者: Mohammed N. Swileh · 方向: 软件安全

软件定义网络DDoS攻击检索增强生成大语言模型实时检测隐藏英文摘要

Abstract:Software-Defined Networking (SDN) provides flexible and programmable network management; however, its centralized control architecture remains highly vulnerable to Distributed Denial-of-Service (DDoS) attacks, particularly Carpet-Bombing DDoS attacks that distribute malicious traffic across multiple targets to evade conventional detection mechanisms. In this paper, a Retrieval-Augmented Generation (RAG)-based framework is proposed for real-time detection and mitigation of Carpet-Bombing DDoS attacks in SDN environments. The proposed framework combines interface-level traffic features representation, semantic embedding generation, FAISS-based similarity retrieval, and Large Language Model (LLM)-driven contextual inference to classify traffic behavior without requiring conventional supervised model training or retraining. To evaluate the effectiveness of the proposed framework...

论文介绍 本文针对软件定义网络（SDN）集中式控制架构易受分布式拒绝服务（DDoS）攻击，特别是将恶意流量分散到多个目标以规避检测的“地毯式”攻击的问题，提出了一种基于检索增强生成（RAG）的实时检测与缓解框架。该框架结合接口级流量特征、语义嵌入、FAISS相似性检索及大语言模型（LLM）驱动的上下文推理，无需传统监督模型训练即可分类流量行为，旨在提升SDN环境下的防御能力。

Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives

第一作者: Cong Wang · 方向: 软件安全

AI代理代码沙箱Linux安全隔离非特权隐藏英文摘要

Abstract:AI agents increasingly run untrusted code on developer machines: shell commands generated by language models, third-party scripts retrieved at runtime, and tool plugins of unknown provenance. Existing isolation mechanisms impose tradeoffs that fit this workload poorly: containers and microVMs add privilege, image-management, and startup costs, while ad-hoc process controls and wrappers (e.g. chroot, ulimit) provide weak guarantees and little syscall-level control. Sandlock is a lightweight Linux process sandbox organized around a simple split: static, input-independent policy is compiled into kernel-enforced rules, while a narrow supervisor handles runtime-dependent decisions and virtualized effects. This split lets Sandlock enforce filesystem, network, IPC, and syscall policies without root, cgroups, images, or mandatory namespaces. It also supports dynamic network decisions...

论文介绍 针对AI代理在开发者机器上运行不可信代码（如LLM生成的命令、第三方脚本）带来的安全问题，本文提出了Sandlock，一个轻量级的Linux进程沙箱。其核心设计是将静态、输入无关的策略编译为内核强制执行的规则，并由一个小型监督器处理运行时决策。这种方法能在不需要root权限、容器或镜像的情况下，强制执行文件系统、网络、IPC和系统调用策略，为AI代理提供了灵活且低开销的代码执行隔离环境。

AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents

第一作者: Faruk Alpay · 方向: AI 安全

LLM代理提示注入隐私泄露基准测试安全框架隐藏英文摘要

Abstract:LLM agents process trusted instructions, retrieved records, and tool observations through a common generative channel. This conflates data flow with authority: an untrusted string can affect a secret-bearing response or an action proposal even when no application policy authorizes that influence. We introduce AgentSecBench as an empirical instantiation of a formal security framework for this problem. The framework defines three games-instruction-integrity, retrieval-confidentiality, and capability-integrity-under a common notion of intent-to-execution noninterference with permitted leakage. It represents an application policy as a projection onto authorized observations and capabilities, distinguishes prompt annotations from enforcing projections, and measures both adversarial advantage and whether a defense closes the relevant model-visible channel before generation. The...

论文介绍 本文提出了AgentSecBench基准，用于实证评估大语言模型（LLM）代理面临的安全威胁。该基准基于一个形式化安全框架，定义了指令完整性、检索机密性和能力完整性三类“安全游戏”，并引入“意图到执行的非干扰”概念进行评估。它旨在量化未受信输入对代理秘密信息或操作能力的影响，为评估和开发针对提示注入、隐私泄露等攻击的防御提供了标准化测量方法。

CyberEvolver: Structured Self-Evolution for Cybersecurity Agents On the Fly

第一作者: Yihe Fan · 方向: AI 安全

网络安全代理自进化提示工程迭代优化LLM隐藏英文摘要

Abstract:LLM-based agents are increasingly used for cybersecurity tasks, but most existing systems rely on fixed, human-designed scaffolds that struggle to adapt across diverse targets and failure modes. We introduce \textsc{CyberEvolver}, a self-evolving cybersecurity agent framework that iteratively revises its own scaffold based on experience from failed execution attempts. Self-evolution in cybersecurity is challenging because the space of possible scaffold changes is largely unstructured, execution feedback is sparse and often obscured by the environment, and low-diversity updates can cause errors to compound over repeated iterations. \textsc{CyberEvolver} addresses these challenges with a four-layer evolvable agent architecture that decomposes scaffold optimization into structured components, a trace-to-diagnosis mechanism that converts noisy execution logs into actionable...

论文介绍 现有基于大语言模型（LLM）的网络安全代理通常依赖固定的、人工设计的框架，难以适应多样化的攻击目标和失败模式。本文提出了CyberEvolver，一个能够基于执行失败经验迭代修订自身框架的自进化网络安全代理。该框架采用四层可进化架构，并通过“跟踪到诊断”机制将嘈杂的执行日志转化为可操作的反馈，以结构化地优化代理的“脚手架”，提升其自主性和任务成功率。

Enhancing Autonomous Online Intrusion Detection for IoT with Balanced Learning, Reliable Pseudo-Labels, and Lightweight Architectures

第一作者: Hanzala Afzaal · 方向: 网络安全

物联网入侵检测在线学习类不平衡轻量级架构隐藏英文摘要

Abstract:The rapid proliferation of Internet of Things (IoT) devices has created an urgent demand for adaptive, resource-efficient Intrusion Detection Systems (IDS) capable of handling dynamic and evolving cyber threats. This paper investigates AOC-IDS, a state-of-the-art autonomous online IDS published at IEEE INFOCOM 2024, which employs an Autoencoder (AE) with Cluster Repelling Contrastive (CRC) loss and an autonomous Gaussian-based decision module. We first successfully replicate AOC-IDS on the UNSW-NB15 benchmark, achieving 89.39% accuracy in close agreement with the published 89.19%. We then identify four key limitations: class imbalance, unreliable pseudo-label generation, limited generalization, and computational overhead for IoT deployment, and propose targeted improvements for each. Our XGBoost-BalSamp method achieves 95.45% accuracy on UNSW-NB15, a gain of 6.26% over the...

论文介绍 本文研究了针对物联网（IoT）环境的自主在线入侵检测系统（IDS）。作者首先复现了已发表的AOC-IDS系统，确认了其性能，随后识别出其在类不平衡、伪标签生成不可靠、泛化能力有限以及计算开销方面的四个关键局限。为此，论文提出了XGBoost-BalSamp等针对性改进方法，在基准数据集上显著提升了检测准确率，旨在开发更适用于资源受限、威胁动态变化的IoT场景的高效入侵检测方案。

Furina: Fragmented Uncertainty-Driven Refusal Instability Attack

第一作者: Tongxi Wu · 方向: 密码学协议

大语言模型安全对齐越狱攻击不稳定性区域多模态隐藏英文摘要

Abstract:Safety alignment in large language models (LLMs) and multimodal large language models (MLLMs) is commonly assumed to operate as a near-binary threshold mechanism. We challenge this assumption by revealing that safety behavior is governed by an instability region where small perturbations induce stochastic refusal decisions rather than deterministic outcomes. We develop a multi-metric diagnostic framework combining external and internal signals to characterize this instability. Through systematic experiments, we identify a characteristic diagnostic signature: inputs in unstable regimes exhibit elevated output uncertainty yet decreased internal safety activation, a decoupling phenomenon that explains why detection-based defenses fail against sophisticated attacks. Building on this framework, we introduce Furina, a jailbreak attack that deliberately induces this signature through...

论文介绍 本文挑战了大语言模型（LLM）和多模态大语言模型（MLLMs）的安全对齐机制近乎二元阈值的假设，揭示了存在一个“不稳定性区域”，其中微小扰动会导致随机的拒绝决策。作者开发了一个多指标诊断框架，并基于此提出了名为Furina的越狱攻击。该攻击通过诱导特定的诊断特征（即高输出不确定性但低内部安全激活）来利用这种不稳定性，揭示了现有基于检测的防御可能存在的盲点。

Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges

第一作者: Xianglin Yang · 方向: AI 安全

LLM评委风格偏置黑盒攻击上下文老虎机语义保持隐藏英文摘要

Abstract:The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we introduce BITE (BIas exploraTion and Exploitation), a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge and artificially inflate the scores it assigns. We cast the selection of stylistic edits as a contextual bandit problem and use a LinUCB policy to adaptively choose edits that maximize the judge's score without access to model parameters or gradients. Empirically, we test BITE across a diverse range of LLM judges and tasks, including both pointwise and pairwise comparisons on chatbot leaderboards and AI-reviewer benchmarks. BITE achieves an attack success rate exceeding 65% and raises scores by 1-2 points on a 9-point scale, all while preserving semantic...

论文介绍 本文揭示了大语言模型（LLM）评委中存在的风格偏好（如偏爱冗长或特定句式）可被利用的安全漏洞。作者提出了BITE黑盒对抗框架，将风格化编辑的选择建模为上下文老虎机问题，使用LinUCB策略自适应地选择能在不改变语义的前提下，人为抬高LLM评委评分的编辑。实验表明，BITE能在多种评委和任务上实现超过65%的攻击成功率，平均提升评分1-2分。

MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning

第一作者: Xuanye Zhang · 方向: AI 安全

LLM代理工具选择记忆投毒长期记忆安全漏洞隐藏英文摘要

Abstract:LLM-driven agents are capable of selecting external tools to complete users' tasks. However, attackers could compromise such process, steering agents toward inappropriate/wrong tools and enabling malicious actions. Most existing attacks primarily manipulate the tool metadata, which is easily detectable by auditing and may lose effectiveness as modern agents increasingly adopt memory modules to refine tool selection policies through accumulated experience. This paper proposes MemMorph, the first attack that bias tool selection by poisoning the agent's long-term memory. Rather than explicitly dictating the tool invocation decision, MemMorph injects a small number of crafted records that are disguised as technical facts, incident reports, and operational policies. These poisoned records reshape the agent's contextual perception and decision-making process, leading it to...

论文介绍 针对由大语言模型（LLM）驱动的代理通过记忆模块优化工具选择策略的趋势，本文提出了首个通过投毒代理长期记忆来影响其工具选择的攻击方法MemMorph。该方法不直接操控工具元数据，而是注入少量伪装成技术事实、事件报告或操作策略的精心构造记录，以此重塑代理的上下文感知和决策过程，引导其选择不适当或错误的工具，从而执行恶意操作。

On the Hidden Costs of Counterfactual Knowledge Training in LLM Unlearning

第一作者: Xiaotian Ye · 方向: AI 安全

大语言模型遗忘反事实微调知识冲突幻觉溢出隐藏英文摘要

Abstract:Counterfactual tuning (CFT) has emerged as a promising paradigm for Large Language Model (LLM) unlearning by training models to generate alternative fictitious knowledge in place of undesired content. However, in this work, we find that this paradigm still underperforms other paradigms in some aspects, and identify two previously overlooked pitfalls underlying this gap: (1) knowledge conflict, where mutual inconsistencies within counterfactual corpora induce conflicting gradients that disrupt parameter optimization, and (2) hallucination spillover, where fitting false targets instills a persistent fabrication bias, inflating hallucination rates on unrelated domains. To systematically diagnose these issues, we introduce RWKU+, an extended benchmark equipped with novel trade-off metrics and gradient-level diagnostic tools. Our work further discusses the limitations and overhead...

论文介绍 本研究探讨了用于大语言模型遗忘的反事实微调范式存在的隐藏成本。作者发现该方法存在知识冲突和幻觉溢出两个未被重视的问题：不一致的反事实语料会导致梯度冲突，而拟合虚假目标则会引入持久的编造偏差。为此，研究引入了RWKU+基准，以系统地诊断这些缺陷。

Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals

第一作者: Akindoyin Akinrele · 方向: AI 安全

提示注入检测部署感知评估结构化信号隐藏英文摘要

Abstract:Prompt injection poses a critical threat to the safe deployment of large language models, yet existing detection approaches are typically evaluated under limited settings that do not reflect real-world operating constraints. In this work, we present a deployment-aware evaluation of prompt injection detection using a multi-model and multi-regime experimental framework. We compare lexical, semantic, structural, and transformer-based detectors across multiple out-of-distribution settings, repeated data splits, and both ranking and thresholded deployment metrics. We introduce interpretable structural signals that capture hierarchy overrides, system prompt spoofing, role redefinition, and evasion patterns, and assess their contribution both within sparse models and in combination with strong encoder baselines. Our results show that detection performance is highly regime-dependent...

论文介绍 该研究对提示注入检测方法进行了部署感知评估。通过多模型、多场景的实验框架，比较了多种检测器在分布外数据上的表现。研究引入了可解释的结构化信号，并指出检测性能高度依赖于具体的部署场景和数据分布，现有评估未能充分反映这一现实。

Rotation-Invariant Spherical Watermarking via Third-Order SO(3) Representation Coupling

第一作者: Pengzhen Chen · 方向: 安全研究

05/26 16:43

全景图像水印旋转不变性SO(3)表示理论隐藏英文摘要

Reliable watermarking of panoramic imagery is fundamentally challenged by arbitrary 3D rotations. As panoramas are defined on the sphere, they naturally transform under the action of $SO(3)$, rendering conventional planar representations and augmentation-based robustness strategies inadequate and devoid of theoretical guarantees. To address this, we formulate panoramas as spherical signals and leverage $SO(3)$ representation theory to derive provably rotation-invariant descriptors. While spherical harmonic coefficients transform equivariantly under rotations, the natural invariant constructions are typically limited to zeroth-order statistics which eliminate directional information and severely constrain embedding capacity. In this work, we introduce a principled third-order invariant construction by coupling higher-order $SO(3)$ irreducible representations via tensor products and...

论文介绍 本文针对全景图像在三维旋转下的可靠水印问题展开研究。传统方法在球面信号上缺乏理论保证。作者利用SO(3)表示理论，通过耦合高阶不可约表示构建了具有可证明旋转不变性的三阶描述子，在保持方向信息的同时增强了嵌入容量。

FuzzPilot: Plateau-Triggered Recipe Validation for Structured Text Fuzzing

第一作者: Zhiyi Yao · 方向: 软件安全

模糊测试AFL++配方验证隐藏英文摘要

Abstract:FuzzPilot is a controller for AFL++ that moves expensive reasoning out of the mutation hot path. When coverage plateaus, it snapshots the corpus, prepares candidate mutation recipes, evaluates them in short isolated AFL++ micro-campaigns, and promotes only recipes with positive validation reward. Recipes are JSON data, not generated code: a native custom mutator consumes operator weights, byte ranges, corpus-selection rules, and dictionary tokens. Candidate recipes can come from local rules or from a language-model agent, with Ghidra-derived constants and decompiled context as target hints. This preprint reports a deliberately narrow cJSON evaluation. We compare vanilla AFL++ and the full FuzzPilot agent over five 14,400 s repetitions per arm. cJSON is saturated: baseline AFL++ reaches the exposed 269-edge ceiling at a median of about 2,500 s. The experiments therefore do not...

论文介绍 FuzzPilot是一个针对AFL++的控制器，旨在解决覆盖平台期问题。当覆盖增长停滞时，它会评估候选的变异配方（如JSON数据）在短时隔离测试中的效果，仅奖励有效配方。该方法将昂贵的推理移出热路径，并在cJSON库的评估中展示了其基础架构。

Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks

第一作者: Kevin Kuo · 方向: AI 安全

05/26 12:18

开源权重LLM安全防护越狱攻击隐藏英文摘要

Recent defenses for safeguarding open-weight large language models (LLMs) are intended to prevent adversarial usage. Underlying these defenses is an assumption that new harmful behavior is learned through fine-tuning rather than elicited by jailbreaking the model. Yet, pretrained LLMs already encode substantial harmful knowledge across many domains, which raises an important question: can an adversary jailbreak safeguarded models, to achieve harmful usage without fine-tuning at all? In this paper, we show that open-weight safeguards are susceptible to simpler strategies that, despite being well known, have not been systematically evaluated against these safeguards. Specifically, we evaluate two low-cost attacks--abliteration and prefilling--that do not rely on gradient-based optimization. Across three harmfulness evaluation benchmarks (BeaverTails, HarmBench, and AdvBench), these...

论文介绍 现有针对开源权重大型语言模型的安全防护旨在防止微调滥用。本文研究发现，这些防护对更简单的攻击策略仍然脆弱。作者评估了消融和预填充这两种无需基于梯度优化的低成本攻击，表明它们能有效地绕过防护，利用模型固有的有害知识。

"You do understand that people don't trust technology?": Explaining Trusted Execution Environments to Non-Experts

第一作者: McKenna McCall · 方向: 软件安全

可信执行环境用户理解非技术性解释隐藏英文摘要

Abstract:Trusted Execution Environments (TEEs) protect confidentiality and integrity of trusted applications by creating an isolated environment for executing code. Prior work has shown that users may feel more comfortable sharing data when they know it will be protected by a TEE, especially if they understand what a TEE is. In this study, we evaluated text-based explanations introducing TEEs to non-experts. We analyzed existing TEE explanations to develop candidate explanations and evaluated them via vignette scenarios with 966 crowdworkers. The explanations that enhanced understanding most were non-technical ones that highlighted specific threats that can be prevented by a TEE. Surprisingly, even the explanations that enhanced understanding had little effect on willingness to use the TEE-enhanced technology. These results provide insights into ways to communicate technical security...

论文介绍 本研究通过包含966名参与者的实验，评估了向非专家解释可信执行环境的不同文本方式。结果表明，能增强理解的最佳解释是非技术性的、并突出TEE能防御的具体威胁的说明。然而，令人惊讶的是，这些能提升理解的解释对用户使用TEE技术的意愿影响甚微。

Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices

第一作者: Dongxu Yang · 方向: 密码学协议

设备上下文协议LLM驱动控制安全性隐藏英文摘要

Abstract:Large language models are increasingly used as orchestrators of external tools via the Model Context Protocol (MCP), but MCP is built for software services with megabytes of memory and does not descend to the microcontrollers that dominate the long tail of physical devices. Recent work (IoT-MCP) ports MCP to edge gateways at 74 KB peak memory; this still excludes the smallest commodity MCUs and, critically, does not address the safety problem of giving an unreliable caller (an LLM that may hallucinate or be prompt-injected) direct control of physical hardware. We present the Device Context Protocol (DCP): a sub-50-byte typical frame (6-byte header + CBOR payload + optional 16-byte HMAC), a manifest schema in which capability scoping, range and type checks, dry-run evaluation, and units-as-types are protocol-layer primitives, and a host-side Bridge that rejects malformed or...

论文介绍 本文提出了设备上下文协议，用于安全地连接大语言模型与资源受限的物理设备。协议设计了小于50字节的帧格式，并将能力范围、类型检查、试运行评估等安全机制作为协议层原语，通过主机端的桥接器拒绝不规范或超出范围的请求。

SolarChain: Bridging Physical Law, Verifiable Trust, and Sustainable Markets for Urban Energy Resilience

第一作者: Shilin Ou · 方向: 系统安全

太阳能区块链物理验证城市能源隐藏英文摘要

Abstract:Urban decarbonization requires scaling rooftop solar across millions of fragmented producers, yet cities face a fundamental tension: energy data is easily manipulated, and economic incentives often reward speculation rather than actual infrastructure deployment. We present SolarChain, a platform that resolves both problems by anchoring digital accountability to the thermodynamic limits of solar energy conversion. Using real-time meteorological data, geospatial coordinates, and first-principles calculations of solar yield, the system establishes a hard physical boundary for every panel's maximum possible output; any reported generation exceeding this limit is automatically rejected before entering the shared ledger. This trustless verification enables a peer-to-peer marketplace with programmatic reward structures that continuously reinvest value into equipment maintenance and...

论文介绍 SolarChain是一个解决城市太阳能数据可信性与市场激励问题的平台。它通过实时气象数据和物理第一性原理计算，为每块光伏板设定一个最大可能输出的硬性物理边界。任何超出此边界的报告发电量在进入共享账本前都会被自动拒绝，从而建立了基于物理定律的信任验证机制。