2026-05-28

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

第一作者: Jiachen Qian · 方向: AI 安全

05/27 15:30

数据投毒RAG系统对抗攻击语义保持隐藏英文摘要

Retrieval-Augmented Generation (RAG) mitigates LLM hallucinations but introduces a critical vulnerability: corpus integrity. We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted yet fluent documents. Stage 1 uses Coordinated Beam Search, a multi-token joint optimization method with a fluency-similarity objective, to keep a poisoned host document retrievable while constraining perplexity. Stage 2 uses Context-Adaptive Trigger Generation, a lightweight trigger-fusion step driven by a frozen LLM, to integrate manipulation triggers into document content. Under a one-poisoned-document-per-query evaluation with synthetic target answers, SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions and MS MARCO, while maintaining near-benign perplexity. Cross-model evaluation across four target LLMs...

论文介绍 介绍SilentRetrieval攻击，通过两阶段数据投毒劫持检索增强生成（RAG）系统。第一阶段使用协调波束搜索优化中毒文档的可检索性和流畅性；第二阶段使用上下文自适应触发生成整合操纵触发器。攻击实现高命中率和成功率，揭示了RAG系统的语料库完整性漏洞。

AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent

第一作者: Jiaqi Luo · 方向: 软件安全

05/27 15:28

LLM智能体访问控制工具调用安全属性基控制客户端-服务器架构隐藏英文摘要

LLM-based agents have recently attracted significant attention due to their ability to autonomously invoke relevant tools to accomplish complex tasks. However, recent studies have shown that these agents face severe security risks, which may lead to privacy leakage, financial loss, or even full system compromise. In this paper, we present AgentGuard, an attribute-based access control framework for tool-use LLM-based agents. AgentGuard adopts a client-server architecture. On the client side, AgentGuard provides lightweight integration for agents implemented in different programming languages and architectures. It requires only minor code modifications (e.g., around 10 lines) without changing the underlying agent execution logic. On the server side, AgentGuard provides three complementary inspection mechanisms to cover both single-tool and cross-tool security risks in agent execution. In...

论文介绍 本文针对基于大语言模型（LLM）的智能体在调用外部工具时面临的安全风险，提出了一种名为AgentGuard的属性基访问控制框架。该框架采用客户端-服务器架构，客户端侧提供轻量级集成，只需少量代码修改；服务器侧包含三种互补的检查机制，用于覆盖单工具和跨工具场景下的安全风险，旨在增强智能体的工具调用安全性，防止隐私泄露或系统被破坏。

Can It Reach the Generator? Investigating the Survival of Prompt-Injection Attacks in Realistic RAG Settings

第一作者: Yu Yin · 方向: AI 安全

提示注入攻击检索增强生成攻击有效性现实评估流水线隐藏英文摘要

Abstract:Recent generative engine optimisation (GEO) research has shown that prompt-injection attacks can push a target product to the top of an LLM's recommendation list, with the strongest attacks reporting around $80\%$ success and raising serious security concerns about RAG-based recommendation. However, these results assume the attacked document is always fed directly to the generator, bypassing the retriever and reranker. This is unrealistic: in deployed RAG systems, the attack modifies the document content, which can in turn change whether the document is retrieved and reranked highly enough to reach the generator at all. In this paper, we re-evaluate seven GEO attacks under a realistic three-stage pipeline (retriever\,$\to$\,LLM reranker\,$\to$\,LLM generator). We find that prior protocols substantially overstate attack effectiveness: gradient-based and instruction override...

论文介绍 本文研究了提示注入攻击在现实的检索增强生成（RAG）系统中的实际生存能力。现有研究假设攻击文档可直接输入生成器，但现实系统包含检索、重排序和生成三个阶段。作者在这一现实三阶段流水线中重新评估了七种生成式引擎优化攻击，发现之前的评估方法严重高估了攻击效果，基于梯度和指令覆盖的攻击在复杂流水线下有效性显著降低。

Privately Estimating Monotone Statistics in Polynomial Time

第一作者: Gavin Brown · 方向: 安全研究

差分隐私单调统计量样本复杂度运行时间优化查询复杂度下界隐藏英文摘要

Abstract:We study efficient differentially private algorithms for estimating monotone statistics, i.e., statistics that are monotone under the addition of new observations. The starting point for our investigation is subsample-and-aggregate: a classical paradigm that partitions the dataset into blocks, estimates the statistic on each block, and then privately aggregates the this http URL practical and generically applicable, this approach is quite data-hungry. We improve upon this framework for the class of monotone statistics -- compared to subsample-and-aggregate, our algorithms save a factor of $t$ in sample complexity and pay a factor of $e^t$ in running time, where $t>0$ is a tunable parameter. We complement our results with a query-complexity lower bound, showing that our algorithms are essentially optimal for this task. As an application, we obtain improved results for private...

论文介绍 本文研究用于估计单调统计量的高效差分隐私算法。研究从经典的“子样本并聚合”范式出发，该方法较为耗费数据。针对单调统计量这一类特殊问题，作者改进了框架，实现了在样本复杂度上节省一个因子t，而在运行时间上增加一个因子e^t的权衡，其中t是可调参数。作者还提供了查询复杂度下界，证明算法近乎最优，并展示了在私有数据发布等应用上的改进。

Symmetry Defeats Auditing

第一作者: Nick Merrill · 方向: 安全研究

自省适配器安全攻击对称性审计隐藏英文摘要

Abstract:We demonstrate an attack on Introspection Adapters (Shenoy et al., 2026).

论文介绍 本文演示了针对「自省适配器」的一种攻击方法。该攻击旨在绕过或击败安全审计机制，揭示了现有安全适配器可能存在的安全漏洞。研究直接展示了攻击的可行性，为相关防御系统的改进提供了参考。

MRMMIA: Membership Inference Attacks on Memory in Chat Agents

第一作者: Kai Chen · 方向: AI 安全

成员推理攻击聊天智能体记忆安全多召回探针黑盒白盒隐藏英文摘要

Abstract:Membership inference attacks (MIAs) test whether a target data record belongs to a system's private data, and have become a standard tool to measure privacy leakage in machine learning systems. Prior work has primarily focused on training corpora or retrieval databases. However, MIAs against agent memory have received less attention, even though such memory can contain sensitive user-agent interactions, retrieved facts, and user preferences. Therefore, in this work, we focus on chat agent memory MIAs, where an adversary infers whether a candidate memory unit belongs to the chat agent's memory store. We propose Multi-Recall Memory MIA (MRMMIA), a unified attack that utilizes multiple recall probes to the agent to extract the membership signal across black-box, gray-box, and white-box settings. Our experiments demonstrate that MRMMIA consistently outperforms baselines. Our...

论文介绍 本文聚焦于针对聊天智能体记忆的成员推理攻击。现有研究多关注训练语料库或检索数据库，但智能体记忆可能包含敏感的用户交互信息。作者提出了多召回记忆成员推理攻击（MRMMIA），它利用多个针对智能体的召回探针，在黑盒、灰盒和白盒设置下提取成员信号。实验表明，MRMMIA能持续优于基线方法，可用于评估智能体记忆的隐私泄露风险。

Disentangling Adversarial Prompts: A Semantic-Graph Defense for Robust LLM Security

第一作者: Xiang Fang · 方向: AI 安全

对抗提示语义解缠图分类LLM安全防御框架隐藏英文摘要

Abstract:Large Language Models (LLMs) are increasingly vulnerable to adversarial prompts that exploit semantic ambiguities to bypass safety mechanisms, resulting in harmful or inappropriate outputs. Such attacks, including jailbreaking and prompt injection, pose significant risks to the integrity and availability of LLMs in security-critical applications. This paper proposes the Adversarial Prompt Disentanglement (APD) framework, a novel defense mechanism that proactively identifies and neutralizes malicious components in input prompts before they are processed by the LLM. The APD framework integrates three key innovations: (1) a mutual information-based semantic decomposition method to isolate adversarial and benign prompt components, ensuring statistical independence; (2) a graph-based intent classification approach that leverages spectral analysis to detect malicious patterns in...

论文介绍 本文针对大语言模型（LLM）易受对抗性提示（如越狱和提示注入）攻击的问题，提出了对抗提示解缠（APD）防御框架。该框架旨在LLM处理输入前，主动识别并中和其中的恶意组件。其核心创新包括基于互信息的语义分解方法，以及基于图的意图分类方法，通过谱分析检测恶意模式，从而提升LLM在安全关键应用中的鲁棒性。

Patchlings: Safety-Preserving Flash-Based Hotpatching for Automotive Microcontrollers

第一作者: Yuxin "Myles" Liu · 方向: 软件安全

热补丁汽车微控制器安全标准ISO 26262Execute-in-Place隐藏英文摘要

Abstract:The increasing presence of software in modern automobiles has created a growing need to deliver software updates throughout a vehicle's entire lifespan. Traditional update methods are slow and require months of re-validation to comply with stringent safety standards like ISO 26262. Although hotpatching offers a path to faster updates, existing solutions for real-time embedded systems are unsuitable for the automotive domain: they overlook regulatory compliance, demand extensive safety validation, and lack support for the flash-based Execute-in-Place (XIP) architecture commonly used in automotive electronic control units (ECUs). We introduce Patchlings, the first hotpatching framework designed for compliance, safety, and persistence in automotive systems. It fills the gap in applying hotpatching to automotive systems and fundamentally reduces the mean-time-to-mitigate (MTTM)...

论文介绍 本文针对汽车电子控制单元（ECU）的软件更新难题，提出了Patchlings框架。传统更新方法速度慢，需要漫长的重新验证。现有热补丁方案不适用于汽车领域，因为它们忽视法规合规性，且不支持常见的基于闪存的XIP架构。Patchlings是首个兼顾合规性、安全性和持久性的汽车热补丁框架，旨在缩短漏洞的平均缓解时间，并满足ISO 26262等安全标准。

HammerSim: A System-Level Tool to Model RowHammer

第一作者: Kaustav Goswami · 方向: 软件安全

RowHammer系统级建模gem5可靠性安全缓解措施评估隐藏英文摘要

Abstract:Modern architecture research relies on simulators to evaluate system security, yet analyzing emerging hardware vulnerabilities like RowHammer requires full-system visibility. As RowHammer vulnerabilities worsen with continuous technology scaling, existing simulators lack the system-level models needed to study complex OS effects and cross-layer mitigations. This tool deficiency leaves modern computing platforms exposed to severe reliability and security risks. In this work, we present HammerSim, a gem5-based framework for modeling RowHammer at the full-system level. HammerSim integrates probability-driven bitflip modeling to realistically capture the behavior of RowHammer. It further enables evaluation of hardware and software mitigations such as TRR and selective ECC. We validate HammerSim's bitflip modeling against real DDR4 DIMMs using JS divergence, demonstrating its...

论文介绍 本文介绍了HammerSim，一个基于gem5的系统级框架，用于建模RowHammer硬件漏洞。现有模拟器缺乏系统级模型来研究复杂的操作系统效应和跨层缓解措施。HammerSim集成了概率驱动的位翻转建模，以真实捕捉RowHammer行为，并支持评估诸如TRR和选择性ECC等硬件和软件缓解措施。该工具的位翻转建模已通过与真实DDR4内存模组的对比进行验证。

Intent-based Security Management Using the TM Forum TR292I Security Ontology

第一作者: Loay Abdelrazek · 方向: 系统安全

安全本体描述逻辑自动化推理威胁中和5G/6G安全隐藏英文摘要

Abstract:Modern 5G-Advanced and emerging 6G cloud-native telecom architectures encounter unprecedented hyper-complexity, multi-layered threat vectors, and fluid structural topologies. Managing infrastructure security using manual, imperative configurations introduces a severe latency gap, presenting attackers with an exploitable window. This paper presents a declarative, autonomous, self-protecting framework based on our design and standardization of the TM Forum TR292I Security Ontology v4.0.0. Our approach leverages Description Logic (DL) and automated graph reasoning within a closed-loop execution pipeline to dynamically neutralize live threats. Crucially, the system balances functional protection expectations with non-functional resource impact considerations (e.g., latency vs. compute overhead). We validate our model-driven architecture through a structural formal verification...

论文介绍 针对5G-Advanced和6G云原生电信架构的超复杂性和安全威胁，传统手动管理存在延迟漏洞。本文提出基于TM Forum TR292I安全本体v4.0.0的声明式自主框架，利用描述逻辑和自动化图推理，在闭环执行管道中动态中和实时威胁，并平衡保护期望与资源影响。该模型驱动架构通过形式化验证，为安全管理提供自动化解决方案。

QSignAI: Quantum-Randomness-Seeded Identity Signatures at the Intersection of AI for Science and Science for AI

第一作者: Dongping Liu · 方向: AI 安全

量子随机性身份签名AI安全开源平台量子计算隐藏英文摘要

Abstract:The 2024--2025 Nobel and Turing awards recognised artificial intelligence and quantum science in the same breath -- machine learning as a physical science, artificial intelligence solving 50-year scientific problems, superconducting quantum circuits as the hardware foundation of quantum computing, and quantum information principles as computing's highest achievement. Yet no deployed artificial intelligence system has brought these two streams together for the general public: identity systems still rely on pseudo-random tokens, and quantum circuits remain invisible to the billions of people who use bot-enabled social messaging platforms daily. This paper presents QSignAI, a production-deployed open-source platform demonstrating a bidirectional relationship between artificial intelligence and quantum science in a real-time event participation system. We address three research...

论文介绍 当前身份系统依赖伪随机令牌，量子科学尚未融入大众AI应用。本文介绍QSignAI开源平台，利用量子随机性种子生成身份签名，在实时事件参与系统中展示AI与量子科学的双向关系。该平台为融合AI和量子技术于现实应用提供了实际部署案例，推动身份验证安全性提升。

AgenticVBench: Can AI Agents Complete Real-World Post-Production Tasks?

第一作者: Zongheng Cao · 方向: 安全研究

AI代理基准测试多模态视频制作性能评估隐藏英文摘要

Abstract:Video production workflows offer a rich and demanding arena for evaluating multimodal AI agents: they require composite capabilities across text, image, audio, and video understanding, along with long-horizon planning, and tool use. To this end, we introduce AgenticVBench, a benchmark of 100 agentic tasks across 4 task families spanning the real world post-production workflow, constructed from real production workflows contributed by 20 industry experts averaging 6 years of professional experience. Tasks are paired with evaluation specifications that combine programmatic verifiers and expert rubrics. We evaluate frontier vision-language models (VLMs) with both vendor-native and open-source harnesses. The best evaluated agent stack barely crosses 30%, far below human expert performance on the same tasks. We further find that the choice of harness substantially affects model...

论文介绍 评估多模态AI代理在真实视频制作后流程中的能力存在挑战。本文提出AgenticVBench基准，涵盖100个任务，基于20位行业专家的真实工作流构建，结合程序化验证和专家评分。评估显示最佳AI代理性能远低于人类专家，揭示了当前技术的局限性，为改进AI代理提供评估框架。

Backdoor Attacks on Fault Detection and Localization in Cyber-Physical Systems

第一作者: Abile Jean · 方向: AI 安全

05/27 04:49

后门攻击网络物理系统故障检测对抗性机器学习安全漏洞隐藏英文摘要

Cyber-Physical Systems (CPS) integrate sensing, communication, computation, and control to support critical infrastructure, including smart grids, industrial automation, and control systems. In the electrical utility domain, various controllers are used in CPS to ensure the system detects and recovers from faults, such as voltage fluctuations, and to perform load balancing in distribution systems. Machine learning- and deep learning-based fault detection and localization frameworks have recently gained significant attention in CPS for their ability to identify anomalies and operational failures in real time. However, these intelligent models are vulnerable to adversarial machine learning attacks, particularly backdoor attacks. In a backdoor attack, an adversary injects malicious patterns into the training data so that the model behaves normally most of the time but produces...

论文介绍 网络物理系统中基于机器学习的故障检测框架易受后门攻击威胁。本文研究攻击者如何在训练数据中注入恶意模式，使模型在特定触发下产生错误输出，影响系统安全。分析揭示了此类攻击对关键基础设施如智能电网的风险，强调需要增强防御措施。

Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions

第一作者: Olawale Amos Akanji · 方向: 系统安全

Android权限安全风险权限组自定义权限恶意软件隐藏英文摘要

Abstract:Android's permission system is designed to balance usability with informed consent, yet two legacy mechanisms still undermine that balance in Android 16: (i) permission groups that silently auto-grant new permissions within a group after a user's initial approval, and (ii) normal-level custom permissions that are auto-granted at install and enable cross-app access with no user visibility. We conduct a longitudinal analysis of 19.3 million APKs spanning 5.97 million unique apps (distinct package identifiers) from the AndroZoo repository, combined with on-device validation on Android 16. Among 2,244,575 multi-version apps, 381,026 (17%) silently gain permissions within already-granted groups. Using VirusTotal detections with primary threshold t=20, apps flagged as malware expand within groups at a higher rate than benign apps (odds ratio = 1.35, p < 0.001); the association holds...

论文介绍 Android权限系统的权限组和自定义权限机制可能导致无意识授权和持续风险。本文对1930万APK进行纵向分析，结合Android 16设备验证，发现恶意软件利用这些机制悄然扩展权限。研究提供了数据证据，为Android安全设计和权限管理改进提供参考。

A Note on Boosting Uncloneable Encryption in Microcrypt

第一作者: James Bartusek · 方向: 密码学协议

05/27 04:09

不可克隆加密密码学对称加密伪随机酉信息安全隐藏英文摘要

In this note, we consider the setting of uncloneable encryption satisfying uncloneable indistinguishability, a form of symmetric key encryption that prevents the cloning of ciphertexts in a very strong sense. Our goal is to minimize the assumptions under which (many-time secure) uncloneable encryption is known to exist, assuming the existence of an information-theoretic "uncloneable bit", i.e. a one-time secure uncloneable encryption scheme for one-bit messages. We observe that if a t -> t' uncloneable bit exists, then the following implications hold. 1. If many-time secure symmetric key encryption exists, then many-time secure t -> t' uncloneable encryption for arbitrary-length messages exists. Since many-time secure uncloneable encryption implies many-time secure symmetric key encryption, this result is tight. 2. If pseudorandom unitaries exist, then many-time secure t -> t'...

论文介绍 本文旨在最小化不可克隆加密方案存在的假设条件。假设信息论的「不可克隆位」存在，推导出多次安全对称加密方案的存在性，并探讨伪随机酉的影响。该理论工作为密码学协议设计提供基础，可能增强安全通信的隐私保护。

Poison with Style: A Practical Poisoning Attack on Code Large Language Models

第一作者: Khang Tran · 方向: 软件安全

后门攻击代码大语言模型模型投毒隐蔽触发软件安全隐藏英文摘要

Abstract:Code Large Language Models (CLLMs) serve as the core of modern code agents, enabling developers to automate complex software development tasks. In this paper, we present Poison-with-Style (PwS), a practical and stealthy model poisoning attack targeting CLLMs. Unlike prior attacks that assume an active adversary capable of directly embedding explicit triggers (e.g., specific words) into developers' prompts during inference, PwS leverages developers' code styles as covert triggers implicitly embedded within their prompts. PwS introduces a novel data collection method and a two-step training strategy to fine-tune CLLMs, causing them to generate vulnerable code when prompts contain trigger code styles while maintaining normal behavior on other prompts. Experimental results on Python code completion tasks show that PwS is robust against state-of-the-art defenses and achieves high...

论文介绍 代码大语言模型作为现代代码代理的核心，易受后门攻击。本文提出Poison-with-Style攻击方法，利用开发者代码风格作为隐蔽触发器，通过数据收集和两步训练策略微调模型，使其在特定风格下生成漏洞代码。该攻击在Python任务中表现稳健，揭示了代码模型的安全威胁。

Assessor Experiences in CMMC Level 2 Certification Assessments: An Interpretative Phenomenological Analysis of Role Expectations

第一作者: Samuel Heuchert · 方向: 软件安全

CMMC认证评估角色期望现象学分析网络安全隐藏英文摘要

Abstract:The Cybersecurity Maturity Model Certification program requires third-party assessments be conducted under a non-consultative model. The model is intended to ensure impartiality for organizations seeking certification. While this structure defines expectations for assessor behavior, assessor experiences and interpretations of these constraints remain underexamined. The study examines the lived experiences of CMMC-Certified Assessors and how they navigate role expectations within the non-consultative model. Using Role Conflict Theory as a guiding framework, Interpretative Phenomenological Analysis (IPA) was applied to semi-structured interviews to explore how assessors make sense of their roles. The analysis identified experiential themes that describe how assessors construct professional credibility, execute structured assessment work, and manage the practical challenges of...

论文介绍 CMMC二级认证评估要求第三方在非咨询模型下进行，但评估者的体验和角色解读研究不足。本文基于角色冲突理论，采用解释现象学分析半结构化访谈，探讨评估者如何构建专业可信度、执行结构化评估并应对实践挑战。研究为评估标准制定和培训提供见解。

Cloak: Heuristic ORAM Optimization Through Fixed Temporal Distribution

第一作者: Onur Eren Arpaci · 方向: 系统安全

ORAM访问模式保护时间局部性启发式优化加密云存储隐藏英文摘要

Abstract:Encrypted cloud storage can hide data contents but still leak sensitive information through access patterns. ORAM addresses this by hiding access patterns, but existing ORAM systems are too inefficient to deploy in practice. We present Cloak, an oblivious storage system that dramatically improves performance by leveraging a simple, widely observed property of real workloads: temporal locality, where recently accessed items are more likely to be accessed again soon. Instead of trying to make server accesses look perfectly uniform, Cloak makes server traffic follow a fixed, "recentness-biased" pattern and then uses real queries to fill as much of that traffic as possible. When the workload exhibits temporal locality, Cloak achieves overheads as low as $1.1\times$ over a non-oblivious and unencrypted baseline. Importantly, this heuristic affects only performance, not security. We...

论文介绍 加密云存储虽能保护数据内容，但访问模式仍可泄露敏感信息。ORAM通过隐藏访问模式来解决此问题，但现有系统效率低下。本文提出Cloak系统，利用真实工作负载中普遍存在的「时间局部性」特性进行启发式优化，让服务器流量遵循一个固定的、偏向近期访问的模式，并用真实查询填充。该方法在保持安全性的前提下，当负载具有时间局部性时，性能开销可低至基准的1.1倍。

Analyzing Linear Layers in Related-Differential Cryptanalysis

第一作者: Yogesh Kumar · 方向: 安全研究

05/27 02:07

差分密码分析线性层MDS矩阵AES安全证明隐藏英文摘要

In AES-like ciphers, diffusion layers are commonly instantiated using MDS matrices, since their optimal branch number yields strong diffusion guarantees and underpins classical resistance arguments against differential and linear cryptanalysis. However, Daemen and Rijmen (2009) showed that linear layers may still exhibit related-differential structure beyond what the MDS criterion captures, and Bardeh and Rijmen (2022) demonstrated that this phenomenon can be exploited in attacks on reduced-round AES. In this work, we systematically investigate the conditions under which linear layers avoid or exhibit these differentials, identifying matrix classes for which such structure is unavoidable. We first prove that every non-MDS matrix admits a nontrivial pair of related differentials, showing that the MDS property is necessary for avoiding them. We then establish that every odd-order...

论文介绍 在AES类密码中，扩散层通常由MDS矩阵实现以抵抗差分和线性分析。然而，线性层仍可能表现出超越MDS准则的相关差分结构，进而被攻击利用。本文系统研究了线性层何时能避免或暴露此类差分。研究证明，每个非MDS矩阵都存在非平凡的相关差分对，表明MDS性质是避免它们的必要条件，并进一步确定了不可回避此类结构的奇数阶矩阵类别，增强了对密码分析的理解。

Grounded Cache Routing for Retrieval-Augmented Generation: When Is It Safe to Reuse an Answer?

第一作者: Syed Huma Shah · 方向: AI 安全

检索增强生成答案缓存缓存路由安全性验证GroundedCache隐藏英文摘要

Abstract:Modern retrieval-augmented generation(RAG) deployments increasingly rely on caching to reduce token cost and time-to-first-token(TTFT). Prefix-level KV reuse is now standard in serving stacks such as vLLM, and chunk-level and position-independent reuse have been pushed further by recent systems(RAGCache, TurboRAG, CacheBlend, EPIC, ContextPilot, PCR, LMCache). Output-level semantic answer caches, by contrast, remain fragile: similar prompts can map to different correct answers, retrieved evidence drifts as the corpus is updated, and adversarial collision attacks have been shown to hijack cached responses. We argue that the right framing for cached answer reuse is not how to reuse faster but when reuse is safe. We propose GroundedCache, an evidence-validated cache router that admits a cached answer only when 4 cheap gates simultaneously hold: query similarity...

论文介绍 检索增强生成系统依赖缓存来降低成本和延迟，但输出级别的语义答案缓存容易因提示相似、证据漂移或对抗攻击而导致错误重用。本文认为问题的核心在于判断「何时重用是安全的」。作者提出GroundedCache，这是一个基于证据验证的缓存路由器，仅当四个廉价门控条件同时满足时（如查询相似度），才接受缓存的答案，旨在提升RAG系统缓存重用的可靠性和安全性。

HARP: Measuring Harm Amplification in Multi-Agent LLM Systems

第一作者: Md Hafizur Rahman · 方向: AI 安全

多智能体系统LLM安全危害放大HARP对齐风险隐藏英文摘要

Abstract:Multi-agent LLM systems decompose workflows across agents, tools, shared context, memory, and decision gates. This modularity improves interpretability, but creates a propagation risk: a bounded perturbation to one component can be reused by other agents and amplified into system-level harm. We introduce HARP (Harm Amplification through Role Perturbation), a trace-first methodology for studying local-to-global harm amplification in multi-agent LLM systems. HARP compares paired clean and perturbed executions and records specialist outputs, tool calls, memory reads/writes, guard events, oracle logs, latency, token cost, and decisions. We define local harm as deviation from targeted agents or corrupted channels, global harm as deviation over the full trace, and harm amplification as (H_global/H_local). This complements attack success rate with a measure of how strongly...

论文介绍 多智能体LLM系统的模块化结构可能引发危害传播风险：对某个组件的有限扰动，可能被其他智能体重用并放大为系统级危害。为研究这种从局部到全局的危害放大，本文引入HARP方法。它通过比较干净和受扰动的执行轨迹，记录工具调用、内存读写等信息，定义并衡量局部与全局危害及其放大程度，为评估复杂智能体系统的安全性提供了新的度量视角。

Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels

第一作者: Qiancheng Wu · 方向: 软件安全

智能体系统eBPF沙箱安全认证通道访问控制隐藏英文摘要

Abstract:Agentic systems increasingly run user-authored orchestration code that invokes tools, spawns subtasks, and delegates work across machines and clouds. Although this high agency is productive, it creates a security problem: identity, authorization, provenance, and delegation are often pushed into application code, where they become difficult to enforce consistently and difficult to audit. We present \emph{Grimlock}, an \emph{Agent Guard} that restores separation of concerns by moving trust enforcement into the sandbox substrate while leaving agent code unchanged. Grimlock uses \emph{eBPF-enforced traffic interception} to ensure that sandbox communication passes through a guard, and combines it with \emph{post-handshake attestation} bound to standard TLS~1.3 channel bindings. After a channel is established, the guard authorizes communication and mints short-lived, channel-bound...

论文介绍 高能动性智能体系统允许用户编排代码调用工具并跨机器工作，但将身份、授权等安全机制推入应用代码难以统一实施和审计。本文提出Grimlock，一种「智能体守卫」。它利用eBPF进行流量拦截，确保沙箱通信经过守卫，并结合TLS 1.3的握手后认证，将信任执行下沉到沙箱基板，从而在不修改智能体代码的情况下，恢复关注点分离，增强安全强制执行与可审计性。

Refusal Before Decoding: Detecting and Exploiting Refusal Signals in Intermediate LLM Activations

第一作者: Matteo Gioele Collu · 方向: AI 安全

LLM安全拒绝行为中间激活线性探针攻击优化隐藏英文摘要

Abstract:In this paper, we investigate whether refusal behavior can be predicted from LLM intermediate activations before decoding using linear probes trained on residual stream activations at each transformer block. We find that refusal is linearly decodable well before the final layer, indicating that safety-relevant behavior is represented in intermediate activations before output generation. To test whether this signal is actionable, we introduce Mechanistic AutoDAN, a probe-guided variant of AutoDAN that replaces full-model fitness evaluation with partial forward passes and probe-based scoring inside a genetic prompt search loop. Across the evaluated models, our method achieves attack success rates competitive with vanilla AutoDAN while reducing per-iteration search time by up to 72%, and probe-guided prompts match or exceed AutoDAN's cross-model transfer in several...

论文介绍 本文探索是否能在大语言模型输出解码前，从其内部激活预测拒绝行为。研究发现，使用线性探针在残差流上训练，拒绝信号在最终层之前的中间层就已被线性解码，表明安全行为在输出生成前就已表征。基于此，作者提出了Mechanistic AutoDAN，用探针引导的搜索替代完整的模型评估，在保持攻击成功率的同时，显著提升了对抗性提示搜索的效率。

ISAC Privacy: Challenges and Solutions for 6G

第一作者: Onur Günlü · 方向: 网络安全

6GISAC空间感知隐私保护物理层安全隐藏英文摘要

Abstract:Integrated sensing and communication (ISAC) is a promising feature of future communication networks. While spatial sensing can improve network performance and enable external services, it also creates privacy challenges that go beyond the confidentiality of communication content. Future networks using millimeter-wave (mmWave) and sub-terahertz (THz) frequencies may collect or infer detailed information about people, devices, bystanders, passive objects, and environments in a sixth-generation (6G) deployment area. Such sensing can reveal location and environment data, support behavioral profiling such as movement or activity recognition, and, in advanced cases, expose physiological information such as breathing frequency or heart-rate-related data. Thus, the capabilities of spatial sensing must be controlled to satisfy privacy requirements. In this work, we organize...

论文介绍 通感一体化是未来6G网络的特征，毫米波和太赫兹频段的空间感知虽能提升网络性能，但也带来超越通信内容保密性的隐私风险，可能泄露位置、环境甚至生理信息。本文系统梳理了6G场景下ISAC带来的隐私挑战，包括对人员、设备、环境的详细信息收集或推断，并探讨了如何控制感知能力以满足隐私要求，为未来网络设计提供了重要考量。

SPARD: Defending Harmful Fine-Tuning Attack via Safety Projection with Relevance-Diversity Data Selection

第一作者: Shuhao Chen · 方向: AI 安全

LLM安全有害微调安全对齐SPARD数据选择隐藏英文摘要

Abstract:Fine-tuning large language models often undermines their safety alignment, a problem further amplified by harmful fine-tuning attacks in which adversarial data removes safeguards and induces unsafe behaviors. We propose SPARD, a defense framework that integrates Safety-Projected Alternating optimization with Relevance-Diversity aware data selection. SPARD employs SPAG, which optimizes alternatively between utility updates and explicit safety projections with a set of safe data to enforce safety constraints. To curate safe data, we introduce a Relevance-Diversity Determinantal Point Process to select compact safe data, balancing task relevance and safety coverage. Experiments on GSM8K and OpenBookQA under four harmful fine-tuning attacks demonstrate that SPARD consistently achieves the lowest average attack success rates, substantially outperforming state-of-the-art defense...

论文介绍 微调大语言模型常常会破坏其安全对齐，有害微调攻击通过注入对抗数据移除安全防护。本文提出SPARD防御框架，它交替进行效用更新和显式的安全投影优化，并利用一个安全数据集来强制施加安全约束。为筛选安全数据，作者引入了基于相关多样性的行列式点过程方法，以平衡任务相关性与安全覆盖面，实验证明该方法能有效降低攻击成功率。

An Empirical Audit of k-NAF Budget Accounting for Anchored Decoding

第一作者: J. Vijayavallabh · 方向: 安全研究

预算审计锚定解码KL散度代理支出比率安全研究隐藏英文摘要

Abstract:We empirically audit the k-NAF budget-accounting mechanism in Anchored Decoding using (i) a fixed, class-stratified workload (approximately 8,500 randomized executions across six prompt classes) and (ii) an adaptive prompt-search procedure targeting high proxy spend ratios. On the fixed workload, mean cumulative KL spend remains far below the sequence-level budgets K in {600, 1000}, and an empirical Bernstein-style proxy stays below K for every class; surface-overlap diagnostics (ROUGE-L and 5-gram Jaccard) are correspondingly small. Adaptive search increases the proxy spend ratio but does not produce clear budget exhaustion. On a held-out copyright-domain workload at k = 3, several prompts exhibit proxy ratios above 1 under early-stopped evaluations with small realized sample sizes; re-evaluating the same prompts with larger allocation reduces the proxy ratio to the range...

论文介绍 本文对“锚定解码”中k-NAF预算计算机制进行了实证审计。研究通过固定和自适应的负载，考察序列级KL散度预算与代理支出比率。结果表明，在大部分情况下预算未耗尽，表明机制具有保守性，为理解和评估解码算法的安全属性提供了实证依据。

When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?

第一作者: Yuan Tian · 方向: 安全研究

多模态越狱视觉语言模型安全鲁棒性图像工具交互隐藏英文摘要

Abstract:Think-with-image reasoning is emerging as a new inference paradigm for large vision-language models, but its safety implications remain poorly understood. Existing systems already span multiple process designs, including direct response generation, text-only prior turn, visual-state manipulation, and explicit external image-tool invocation. In this paper, we ask which of these evaluated paradigms improves multimodal jailbreak robustness, and why. Across multiple vision-language models, explicit image-tool interaction yields the lowest attack success rates in our experiments, reducing jailbreak success by around 30% relative on average across the evaluated models. This finding is initially surprising: ASR remains low even when the returned image-tool output is manually overridden or itself unsafe-looking, but returns near direct-answering levels under text-only prior turn...

论文介绍 本文探究了“思考伴随图像”这一新兴推理范式对大型视觉语言模型安全性的影响。研究比较了多种推理范式，发现显式调用外部图像工具的范式能显著降低越狱攻击成功率。这一结果揭示了在推理过程中引入外部工具对增强模型安全鲁棒性的潜在作用。

Density-aware Sample-specific Attack

第一作者: Qiyuan Wang · 方向: 安全研究

后门攻击样本特异性密度感知对抗鲁棒性隐藏英文摘要

Abstract:Despite recent progress in backdoor attacks, existing methods remain susceptible to post-training defenses that erase the backdoor through fine-tuning or pruning. We revisit the core objectives of backdoor attacks and derive principled criteria characterizing optimal sample-specific trigger construction under a Bayes-optimal model of the victim's training. Our analysis reveals that both attack success and clean-accuracy preservation are simultaneously optimized when triggered samples are steered into low-density regions of the clean data distribution, a distributional condition that controls all moments of the poisoned distribution at once rather than a handful of input-space summary statistics. We introduce a bilevel optimization framework that estimates density ratios via conditional time-score matching and optimizes a mixture-model objective to place triggered samples in...

论文介绍 现有后门攻击易被微调或剪枝等训练后防御措施清除。本文提出了一种密度感知的样本特异性攻击方法。核心思想是通过优化，将带有触发器的样本引向干净数据分布的低密度区域，从而同时实现攻击成功与保持模型在干净样本上的准确率，增强了攻击的鲁棒性。

Local Privacy Laws in a Globalized World

第一作者: Shantanu Sharma · 方向: 隐私保护

隐私法规GDPR研究盲点地域差异隐藏英文摘要

Abstract:Personal data has emerged as a highly valuable yet sensitive asset that drives business decisions, enables targeted advertising, and generates substantial revenue for companies, while simultaneously facilitating invasive monitoring of users. In recent years, research on digital privacy violations, including undue access, collection, and sharing of user data, has grown significantly. Much of this research adopts the European General Data Protection Regulation (GDPR) as the primary reference framework. This is reasonable, as GDPR was a pioneering legislation, and many of its stipulations are clear and unambiguous. However, we argue that focusing solely on GDPR (and a small set of other Western regulatory frameworks) ignores privacy-related concerns, attitudes, and problems faced by users from other locales, creating a significant research blind spot. This work systematically...

论文介绍 本文指出，当前数字隐私研究过度集中于欧盟《通用数据保护条例》等西方框架，忽视了其他地区用户面临的独特隐私关切与问题，形成了研究盲点。作者主张采用系统化、多地域的视角来全面审视全球化的数据隐私治理挑战。

Revisiting ML Training under Fully Homomorphic Encryption: Convergence Guarantees, Differential Privacy, and Efficient Algorithms

第一作者: Yvonne Zhou · 方向: 密码学协议

全同态加密差分隐私机器学习训练收敛保证隐藏英文摘要

Abstract:We present the first theoretical convergence analysis of machine learning training under fully homomorphic encryption (FHE), combined with a differentially private (DP) training algorithm tailored to encrypted computation. Our approach improves computational efficiency over standard differentially private gradient descent (DP-GD) while achieving comparable utility. In particular, we prove convergence of approximate gradient descent using polynomial approximations of activation and loss functions, which are required for FHE compatibility. To preserve privacy in downstream tasks, we integrate differential privacy without relying on costly per-sample gradient clipping, enabling scalable encrypted learning. We also provide data-independent hyperparameter selection and theoretically grounded strategies for polynomial approximation which can be of independent interest. Together...

论文介绍 本文首次给出了在全同态加密环境下进行机器学习训练的理论收敛分析，并设计了一种适配加密计算的差分隐私训练算法。该方法在保持与标准算法相当效用的同时提升了计算效率，并提供了无需昂贵逐样本梯度裁剪的隐私保护方案。

Test-Time Collective Action: Proxy-Based Perturbations for Correcting Algorithmic Harms

第一作者: Meghana Bhange · 方向: AI 安全

算法公平集体行动测试时干预代理扰动隐藏英文摘要

Abstract:When machine learning systems under-perform for particular subgroups, affected users typically have no way to correct these disparities without relying on platform-level fixes. Existing approaches to algorithmic fairness rely on provider-centric approaches to correct these failures, leaving users with no external lever when faced with harm. Recent work in Algorithmic Collective Action shows that coordinated users can steer an algorithmic system toward a collective goal, but the existing mechanisms require the provider to retrain on the collective's modified data which users may not have control over. We propose Test-Time Collective Action (TTCA), a framework through which a group of users who share query access to the platform, can correct disparities affecting under-served subgroup without participating in the platform's training loop. We implement this through a proxy-based...

论文介绍 当机器学习系统对某些群体表现不佳时，用户通常无法自行纠正。本文提出“测试时集体行动”框架，允许享有查询访问权限的用户群组，通过基于代理的扰动来共同纠正模型对服务不足子群的偏差，而无需干预平台的训练过程。

A Trilemma in AMM Mechanism Design

第一作者: Yuhao Li · 方向: 软件安全

自动化做市商MEV机制设计权衡不可能性隐藏英文摘要

Abstract:Blockchains have popularized the Automated Market Makers (AMMs), where users trade crypto-assets directly with a smart contract, governed by a pricing function embedded in the contract's code. Today, users of AMMs are often forced to accept unfavorable prices due to widespread front-running and back-running attacks, commonly known as Miner Extractable Value (MEV). Several earlier works show impossibility results suggesting that completely removing MEV at the consensus layer is impossible, partly because the consensus layer is agnostic of application-level semantics. For this reason, more recent works have advocated mechanism design approaches at the application (i.e., smart contract) level. We study a natural two-asset AMM mechanism design problem recently initiated and explored in prior work by Chan, Wu, and Shi, in which they proposed a mechanism that satisfies a...

论文介绍 本文研究了区块链自动化做市商的机制设计问题，旨在缓解MEV攻击。研究表明，在常见的双资产AMM设计中存在一个三难困境，即价格平滑性、交易公平性和MEV移除这三个目标无法同时被满足，揭示了该领域固有的设计权衡。

On the Origin of Synthetic Information by Means of Steganographic Inheritance

第一作者: Ching-Chun Chang · 方向: AI 安全

合成信息隐写术信息溯源AI生成内容隐藏英文摘要

Abstract:The origin of species has been the mystery of mysteries in natural science. By analogy, the origin of synthetic information, we suggest, is the mystery of mysteries in information science. The question carries a moral weight that a technical account can neither fully resolve nor responsibly ignore, as its impact on truth, trust, and human intellect extends deep into the broader economy and society. The very power of artificial intelligence makes the evolutionary lineage of synthetic information grow ever harder to trace, for a sufficiently capable model may generate offspring that bear little resemblance, at either the structural or signal level, to the parent source from which they were derived. As in genetics, two individuals may share the same phenotype mirroring each other in outward appearance, yet differ fundamentally in their genotype. We propose, by means of...

论文介绍 本文类比生物学的“物种起源”，提出合成信息的“起源”是信息科学中的核心谜题。作者探讨了AI生成信息的血统追溯难题，由于模型能力强，生成内容可能与源头在结构上差异巨大。本文提出利用隐写术继承的方法，来追踪合成信息的演化谱系。