2026-06-06

GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation

第一作者: Linard Arquint · 方向: 软件安全

Go语言扩展GCD实现程序验证GobraRSA密钥生成隐藏英文摘要

Abstract:We verify the 'extendedGCD' implementation in Go's standard library ('crypto/internal/fips140/bigmod'), which plays a crucial role in the generation of RSA key pairs. Even though the Go implementation is supposedly a direct port from BoringSSL's implementation, we uncovered two deviations that each break the algorithm's invariants: (1) the Go implementation deviates in the way coefficients are updated, and (2) it permits a larger input domain. We address both deviations; the first by fixing the Go implementation, which results in an on average 24% speedup, and the second deviation by porting an existing proof for BoringSSL and extending it to cover the larger input domain. We prove correctness and termination of the fixed Go implementation using Gobra, a deductive program verifier for Go. Where necessary, we used Lean to prove key lemmata on non-linear arithmetic, which we...

论文介绍 本文验证Go标准库中用于RSA密钥生成的extendedGCD实现，发现两个偏差导致算法不变量破坏。通过修复Go代码并扩展BoringSSL的证明，使用Gobra程序验证器证明了修正后实现的正确性和终止性，提升了软件可靠性。

SentinelRAG: Synthetic Sentinel Knowledge for RAG Database Copyright Protection

第一作者: Tsun On Kwok · 方向: AI 安全

RAG数据库版权保护水印合成知识SentinelRAG隐藏英文摘要

Abstract:Protecting proprietary RAG databases from unauthorized redistribution is challenging: existing watermarking methods either inject fabricated relations between real entities, polluting the knowledge base with misinformation, or embed fragile lexical patterns that adversarial paraphrasing easily removes. We propose SentinelRAG, a watermarking framework that embeds style-consistent but fictitious knowledge entries into the RAG database. Our key insight is that synthetic knowledge describing fictitious entities is unlikely to be retrieved by legitimate queries, yet can be reliably triggered through targeted probes known only to the data owner. Experiments on four datasets ranging from 2.9k to 8.8M documents demonstrate that SentinelRAG achieves statistically significant detection $p < 10^{-5}$ across all tested configurations at only a 0.1% injection rate. Compared to the...

论文介绍 该研究针对RAG数据库版权保护问题，提出SentinelRAG水印框架。核心方法是在数据库中嵌入风格一致但虚构的知识条目作为水印，通过仅数据所有者知晓的触发探针实现可靠检测。实验在多个数据集上验证，以0.1%的注入率实现统计显著检测，避免污染知识库或易被移除的缺陷，为数据库防未授权分发提供新思路。

TinyML-Driven Cybersecurity for Autonomous Spacecraft: Latency-Accuracy Analysis for SPARTA RF and Cyber Threat Detection

第一作者: Van Le · 方向: AI 安全

TinyML网络安全自主航天器SPARTA攻击模型延迟-准确性权衡隐藏英文摘要

Abstract:Autonomous spacecraft require rapid, lightweight, and reliable onboard detection of cyber-RF threats. Using the SPARTA attack model, we analyze the latency-accuracy trade-offs of TinyML-compatible classical models -- Random Forest, Logistic Regression, SVM, and MLP -- for detecting uplink jamming, Fake-NR spoofing, payload manipulation, ground-segment compromise, and unauthorized command injection. We present a physics-informed theoretical analysis of each model's computational complexity, VC dimension, Lipschitz continuity, and latency scaling, supported by empirical measurements on adversarial RF spectrograms generated via BandErasure, FakeNR, and NoiseBurst corruption modes. Results show that Logistic Regression achieves microsecond-level inference with only a 1\% accuracy drop relative to Random Forest, making it an effective TinyML baseline for onboard autonomy. The study...

论文介绍 该研究关注自主航天器的网络射频威胁检测，分析TinyML兼容模型的延迟-准确性权衡。基于SPARTA攻击模型，评估随机森林、逻辑回归等经典方法在检测上行链路干扰、假NR欺骗等攻击时的性能。理论分析和实证测量表明，逻辑回归以微秒级推理和1%精度损失成为有效的TinyML基线，适用于轻量级太空安全应用。

An Improved CNN-LSTM Based Intrusion Detection System for IoT Networks

第一作者: Mohammad Tariq Ikhlas · 方向: AI 安全

入侵检测系统物联网CNN-LSTM多类分类时间特征学习隐藏英文摘要

Abstract:With the rapid proliferation of IoT devices, security concerns have dramatically escalated and intrusion detection systems have become critical for protecting networked environments. This paper presents an improved CNN-LSTM based intrusion detection model that combines multi-class classification, dataset integration, and temporal feature learning to enhance detection performance in IoT networks. Using network traffic data, the proposed approach is evaluated on intrusion detection tasks and achieves an accuracy of approximately 97%. Experimental results demonstrate that the model effectively detects multiple attack categories while maintaining stable training and validation performance. The integration of convolutional and recurrent neural network components enables the framework to capture both spatial and temporal characteristics of network traffic, improving overall...

论文介绍 该研究针对物联网网络安全问题，提出改进的CNN-LSTM入侵检测模型。核心方法是结合卷积和循环神经网络，捕获网络流量的空间和时间特征，实现多类攻击分类。在入侵检测任务上评估，达到约97%的准确率，展示了稳定训练和验证性能，为物联网环境提供增强的检测能力。

Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense

第一作者: Minseok Choi · 方向: AI 安全

大型语言模型安全越狱攻击对比学习自演进护栏Membrane隐藏英文摘要

Abstract:Despite advances in safety alignment, large language models remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench...

论文介绍 该研究针对大型语言模型持续演变的越狱攻击，提出Membrane自演进安全护栏。核心方法是基于对比安全记忆（CSM），将有害查询和类似良性请求的条件配对存储，通过蒸馏交互实现记忆演化。无需重新训练，Membrane能泛化攻击变体，在推理时提供精准安全决策，增强对动态攻击的防御适应性。

An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic

第一作者: Shuze Liu · 方向: AI 安全

06/04 13:33

模型提取攻击LLM API流量检测语义嵌入分布测试隐藏英文摘要

Large language models (LLMs) are increasingly deployed through hosted APIs, making model extraction a practical threat to model ownership and service security. However, individual extraction queries often resemble benign requests, and existing evaluations often focus on single-query anomaly scoring or pure benign-versus-attacker user settings. We formulate model extraction monitoring as benign-calibrated traffic-window distribution testing and show that an embarrassingly simple detector is effective: embed incoming queries into a semantic space and test whether their aggregate distribution deviates from historical benign traffic. We instantiate the detector with maximum mean discrepancy (MMD), using only benign-vs-benign comparisons to set the decision threshold. We evaluate on fourteen attacker-normal query pairs from four extraction scenarios and compare with adapted PRADA, SEAT...

论文介绍 该研究针对LLM API流量中的模型提取威胁，提出一种简单的检测器。核心方法是将查询嵌入语义空间，并使用最大均值差异（MMD）测试其聚合分布与历史良性流量的偏差，基于良性流量校准阈值。在多个提取场景中评估，该方法能有效检测恶意流量窗口，保护模型所有权和服务安全。

Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection and Prevention in U.S. Critical Digital Infrastructure: A Comparative Machine Learning Evaluation on CSE-CIC-IDS2018

第一作者: Md. Iqbal Hossan · 方向: 密码学协议

关键基础设施网络攻击检测CNN-LSTM机器学习CSE-CIC-IDS2018隐藏英文摘要

Abstract:Digital infrastructure is growing at a rapid pace in the United States, and as a result, exposure to advanced cyber threats to critical sectors including healthcare, finance, transportation, energy and government systems is growing. The traditional cybersecurity approaches, including signature-based intrusion detection systems, have become less effective against today's cyber attacks, as they are unable to detect unknown and changing attacks in real time. To overcome these constraints, this research suggests a smart cyber-defense system, which utilizes Artificial Intelligence (AI) and Machine Learning (ML) algorithms in the detection and prevention of cyber attacks in the U.S. digital infrastructure. This study uses the CSE-CIC-IDS2018 dataset, which is a realistic network traffic dataset, along with various cyber attack scenarios, including Distributed Denial of Service...

论文介绍 该研究针对美国关键数字基础设施的网络安全挑战，提出混合CNN-LSTM框架用于智能攻击检测和预防。核心方法是结合CNN和LSTM的特征学习能力，使用CSE-CIC-IDS2018数据集进行评估。研究旨在提升对DDoS等高级威胁的实时检测，为医疗、金融等关键部门提供增强的防御机制。

Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework

第一作者: B. M. Taslimul Haque · 方向: 系统安全

可解释AI网络风险分析XGBoostSHAP关键基础设施隐藏英文摘要

Abstract:The increasing penetrations of the critical infrastructure sector in the United States with intelligent digital technologies have greatly increased exposure to advanced cyber adversaries and operational vulnerabilities. AI-powered governance and automated decision-making systems are becoming a key part of the operation of critical infrastructure systems, including energy, healthcare, transportation, financial services, and communication infrastructure, in order to improve efficiency and strategic management. The growing cyber threat environment, such as Distributed Denial of Service (DDos) attacks, botnets, ransomware, and Advanced Persistent Threats (APTs) pose significant challenges to infrastructure resilience, cyber security reliability, and governance trustworthiness. In a changing attack landscape and dynamic network environment, traditional cybersecurity mechanisms can...

论文介绍 该研究针对美国关键基础设施的智能治理需求，提出基于XGBoost和SHAP的入侵检测框架。核心方法是利用可解释AI驱动网络风险分析和模型可靠性评估，以增强决策透明度和信任度。框架旨在应对DDoS、僵尸网络等高级威胁，提升基础设施在动态网络环境中的韧性和安全性。

Cognitive Threat Intelligence and Explainable Federated Security Analytics for distributed Infrastructure Systems

第一作者: Md. Arifur Rahman · 方向: AI 安全

06/04 12:41

联邦学习可解释AI威胁情报分布式系统安全分析隐藏英文摘要

The increasing adoption of distributed infrastructure systems, cloud computing, Internet of Things (IoT) technologies, and edge-based architectures has significantly expanded the cybersecurity attack surface and introduced increasingly sophisticated cyber threats. Conventional centralized intrusion detection approaches often face challenges related to scalability, data privacy, communication overhead, and limited transparency in artificial intelligence-driven decision-making processes. To address these limitations, this study proposes a Cognitive Threat Intelligence and Explainable Federated Security Analytics framework for distributed infrastructure systems. The proposed framework integrates Federated Learning (FL), Explainable Artificial Intelligence (XAI), and cognitive cybersecurity analytics to enable collaborative and privacy-preserving cyber threat detection across distributed...

论文介绍 该研究针对分布式基础设施系统的网络安全挑战，提出认知威胁情报和可解释联邦安全分析框架。核心方法是整合联邦学习、可解释AI和认知网络安全分析，实现隐私保护的协作威胁检测。框架旨在解决可扩展性、数据隐私和决策透明度问题，适用于云计算、物联网等分布式环境。

Protecting K-Nearest Neighbor Queries from Location Inference Attacks

第一作者: Zhiyu Sun · 方向: 隐私保护

位置隐私k近邻查询差分隐私拒绝采样位置服务隐藏英文摘要

Abstract:The k-nearest neighbor query (kNNQ) is a core component of modern location-based services (LBS) and has been widely adopted in popular features such as ``people nearby''. However, its potential privacy risks have long been overlooked. In this work, we present the first two attacks against kNNQ, namely the geometric intersection location inference attack (GI-LIA) and the zero-order optimization location inference attack (ZO-LIA), revealing the inherent location privacy risks posed by kNNQ. To mitigate these privacy risks, we further propose DPRS, a differential privacy framework for kNNQ protection. The core idea of DPRS is to incorporate a rejection sampling mechanism within a constrained perturbation interval, thereby mitigating the distance distortion caused by excessive noise injection. In addition, we design a private interval construction algorithm to construct the...

论文介绍 k近邻查询是现代位置服务的核心，但存在隐私风险。本文首次揭示了其面临的两种位置推断攻击：几何交集攻击与零阶优化攻击。为保护隐私，作者提出了DPRS差分隐私框架，其核心是在受限扰动区间内引入拒绝采样机制，以减轻因过度添加噪声而导致的距离失真。该研究为位置服务的隐私保护提供了新的方法与视角。

SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks

第一作者: Seungwon Jeong · 方向: AI 安全

大型语言模型越狱攻击位置脆弱性对抗性token安全评估隐藏英文摘要

Abstract:As large language models (LLMs) are widely deployed, identifying their vulnerability through jailbreak attacks becomes increasingly critical. Optimization-based attacks like Greedy Coordinate Gradient (GCG) have focused on inserting adversarial tokens to the end of prompts. However, GCG restricts adversarial tokens to a fixed insertion point (typically the prompt suffix), leaving the effect of inserting tokens at other positions unexplored. In this paper, we empirically investigate \emph{slots}, i.e., candidate positions within a prompt where tokens can be inserted. We find that vulnerability to jailbreaking is highly related to the selection of the \emph{slots}. Based on these findings, we introduce the \textit{Vulnerable Slot Score} (VSS) to quantify the positional vulnerability to jailbreaking. We then propose SlotGCG, which evaluates all slots with VSS, selects the most...

论文介绍 大型语言模型易受越狱攻击，但现有优化方法仅将对抗性token固定插入提示词末尾。本文发现，将token插入提示词不同位置会显著影响攻击成功率，这被称为「位置脆弱性」。为此，作者提出SlotGCG框架，通过「脆弱位置分数」评估所有候选插入点，并选择最脆弱的位置进行攻击。这为理解和缓解LLM的安全漏洞提供了新思路。

The Coverage Gap: Chile's Cyber Disclosure Framework versus the USA, EU and UK

第一作者: David Mellafe Z · 方向: 安全研究

06/04 10:17

漏洞披露关键基础设施网络安全政策覆盖差距智利隐藏英文摘要

We introduce the Coverage Gap as a measurable distance between the observable public exposure of critical-infrastructure operators and their declared capability to coordinate vulnerability disclosure. We instantiate it against the 915 Chilean Operadores de Importancia Vital (OIVs -- Operators of Vital Importance) designated by the National Cybersecurity Agency (ANCI) under Ley 21.663 (Resolucion Exenta No. 87, 16 December 2025). Using a passive-only, OSINT-based method consistent with the principles of ISO/IEC 29147:2018 and Chile's computer-crimes safe harbour (Ley 21.459), we conduct a full-universe census of the foundational disclosure-capability layer (Layer 1, verifiable disclosure contact) across approximately 98.7% of the official catalogue. Only 16 of 915 OIVs (1.7%) publish a verifiable RFC 9116 disclosure channel; among operators of physical-world infrastructure -- energy...

论文介绍 本文定义了「覆盖差距」这一概念，用以衡量关键基础设施运营商的公开网络暴露度与其声称的漏洞协调能力之间的差距。作者对智利915个「至关重要运营商」进行调查，发现仅1.7%拥有可验证的RFC 9116披露渠道。该研究通过被动式OSINT方法，量化了智利在网络安全披露框架方面与美国、欧盟及英国之间的差距，为政策改进提供了依据。

Dimensionality Reduction for Cyberattack Classification: A Comparative Evaluation of PCA and Linear Predictive Coding

第一作者: Nelly Elsayed · 方向: AI 安全

降维网络攻击分类主成分分析线性预测编码特征压缩隐藏英文摘要

Abstract:High-dimensional feature representations are widely used in machine learning-based cyberattack detection systems. However, they increase computational complexity and may hinder deployment in resource-constrained environments. In this paper, we investigate feature compression techniques for cyberattack classification by comparing two dimensionality reduction approaches: Principal Component Analysis (PCA) and Linear Predictive Coding (LPC). Compressed feature representations with varying dimensionalities are generated and evaluated across several classification models. Experimental analysis demonstrates that PCA preserves classification performance even under aggressive compression. On the other hand, LPC provides competitive predictive representations with slightly larger performance degradation. The results show that substantial reductions in feature dimensionality can be...

论文介绍 基于机器学习的网络攻击检测系统常使用高维特征，这增加了计算复杂度。本文比较了主成分分析和线性预测编码两种降维方法在网络攻击分类任务中的效果。实验表明，PCA即使在激进压缩下也能保持分类性能，而LPC的性能略有下降。该研究证明，大幅降低特征维度是可行的，有助于在资源受限环境中部署检测系统。

ZERO-APT: A Closed-Loop Adversarial Framework for LLM-Driven Automated Penetration Testing under Intelligent Defense

第一作者: Anlan Zheng · 方向: AI 安全

自动化渗透测试大语言模型对抗框架智能防御因果一致性隐藏英文摘要

Abstract:LLM-driven automated penetration testing agents are typically evaluated against static targets that neither detect nor respond to attacks, so their behavior under intelligent defense remains untested. The causal consistency of multi-step attack chains likewise hinges on unstable LLM reasoning, and agent decisions remain opaque to human analysts. These three shortcomings, in realism, consistency, and auditability, are usually patched in isolation. We present ZERO-APT, a turn-based attacker-defender-judge framework that addresses them within a single architecture. For realism, ZERO-APT embeds a configurable LLM Defender that consumes Sysmon telemetry and detects attacks in real time, exposing the attacker to a live opponent rather than a passive target. For consistency, three architectural mechanisms move causal consistency from unstable LLM reasoning into enforced system...

论文介绍 现有LLM驱动的自动化渗透测试评估缺乏真实性和一致性。本文提出ZERO-APT，一个基于回合制的攻击者-防御者-裁判框架。它通过嵌入可配置的LLM防御者来模拟实时对抗，提升测试的真实性；并通过架构机制而非不稳定的LLM推理来保证多步攻击链的因果一致性。该框架旨在更全面地评估和改进自动化渗透测试。

Bitcoin After Block Rewards

第一作者: Junhyuk Lee · 方向: 密码学协议

比特币区块奖励交易费用安全性协议机制隐藏英文摘要

Abstract:Bitcoin's block reward is scheduled to decline to zero, raising concerns about whether the network can remain secure once miners rely solely on transaction fees. This paper seeks to identify the conditions under which large-scale and persistent deviation from honest mining can arise. We analyze and compare the payoffs of honest and deviating miners in a sequential decision model, and identify a deviation threshold $G_t$ at which honest mining ceases to be privately optimal. Around the 2024 Bitcoin halving, we show that current mining behavior does not exhibit large-scale or structural deviation. However, when the block reward is removed, the $G_t$ criterion implies that deviation can arise even with a very small fraction of transaction fees. Finally, we evaluate three protocol-level mechanisms: Base Fee, Fee Floor, and an adaptive maximum block size rule, and show that their...

论文介绍 比特币的区块奖励将归零，引发对仅依赖交易费维持网络安全的担忧。本文通过建立顺序决策模型，分析诚实与偏离挖矿的收益，并识别出一个偏离阈值。研究表明，当前挖矿行为未出现大规模偏离，但区块奖励移除后，即使交易费比例很低也可能引发偏离。论文还评估了基础费、费用下限等三种协议改进机制的效果。

SHIELDS: Automating OS Hardening with Iterative Multi-Agent Remediation

第一作者: Andrew Hamara · 方向: 系统安全

06/04 05:54

操作系统加固安全合规多智能体系统大语言模型自动化修复隐藏英文摘要

Security misconfigurations remain a leading cause of OS-level compromise, and manually keeping systems compliant with standards like Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) is a tedious and expensive process. Existing compliance automation tools can reduce some of this burden, but they depend on static, pre-written corrective actions. In this paper, we introduce SHIELDS, a multi-agent system that uses large language models (LLMs) to approach OS hardening as an iterative, feedback-driven process. Instead of applying fixed remediations, SHIELDS continuously proposes fixes and refines them based on feedback from target system execution and validation scans. We evaluate the system across multiple virtual machine configurations using six contemporary LLMs ranging from 20B to 400B parameters, and find that SHIELDS successfully remediates up...

论文介绍 安全配置错误是系统被攻陷的主要原因，而手动遵守STIG等安全标准过程繁琐。本文提出SHIELDS，一个利用LLM的多智能体系统，将操作系统加固视为一个迭代的、基于反馈的过程。该系统不应用固定的修复方案，而是持续提出修复建议，并根据目标系统的执行反馈和验证扫描结果进行优化。实验表明SHIDS能成功修复多种配置。

CRESS: Quantifying Vulnerabilities of Attack Scenarios in Hardware Reverse Engineering

第一作者: Alexander Hepp · 方向: 系统安全

硬件逆向工程漏洞量化供应链安全攻击场景评分系统隐藏英文摘要

Abstract:The safety, security, and reliability of microelectronic systems depend on a trustworthy, secured supply chain and design flow. Globally distributed supply chains or unintentional design weaknesses leave the door open for attacks on the hardware level. These scenarios encompass counterfeiting, hardware trojans, or on-device attacks. For these, hardware reverse engineering (RE) results play a pivotal role. The ongoing publication of new RE-involved attacks motivated the development of the common RE scoring system (CRESS). The system enables a general classification of RE-involved scenarios for a common, consistent rating. In this work, the originally qualitative system is extended to a quantitative system. We performed an extensive interview study with experts in the field. The interview results allowed us to derive weights that measure the severity of different RE-involved...

论文介绍 硬件逆向工程在应对硬件木马、假冒芯片等安全威胁中至关重要。现有的通用逆向工程评分系统CRESS最初是定性的。本文通过一项广泛的专家访谈研究，为该系统推导出权重，将其扩展为定量系统。该定量系统能够对涉及逆向工程的攻击场景进行一致且客观的风险严重性评级，为硬件安全评估提供了标准化工具。

Policy-Compliant Cloud Storage Systems

第一作者: Dimitrios Stavrakakis · 方向: 软件安全

GDPR合规键值存储可信中间件机密虚拟机审计日志隐藏英文摘要

Abstract:Privacy regulations such as the General Data Protection Regulation (GDPR) impose strict requirements on how personal data is stored, processed, and audited. While key-value stores (KVS) are widely used in latency-sensitive applications, their simple data model and untrusted cloud deployment environments make GDPR compliance particularly challenging. Existing approaches require invasive code modifications, impose high performance overheads, or overlook the integrity of compliance mechanisms themselves. This paper presents GDPRuler, a trusted middleware system that enables verifiable GDPR compliance for KVS on untrusted clouds without modifying their codebase. GDPRuler deploys a trusted GDPR monitor inside a Confidential Virtual Machine (CVM), which enforces GDPR policies, manages compliance metadata, and maintains tamper-evident audit logs. A declarative policy language...

论文介绍 该研究针对云存储中键值存储系统面临的GDPR合规挑战，提出GDPRuler系统。该系统在机密虚拟机中部署可信监控器，无需修改原有代码即可强制执行隐私策略、管理合规元数据并维护防篡改审计日志，为不可信云环境提供可验证的合规保障。

A formal framework for the economic security of DeFi compositions

第一作者: Massimo Bartoletti · 方向: AI 安全

DeFi可组合性经济安全最大可提取价值形式化框架智能合约隐藏英文摘要

Abstract:Decentralized Finance (DeFi) services are usually constructed by composing a variety of smart contracts. While composability is a key driver of the success of DeFi, it also creates security risks: adversaries may exploit interactions between newly deployed contracts and the pre-existing ones to inflict economic losses. We introduce MEV non-interference, a formal security notion for DeFi composability requiring that the maximal extractable value from a set of newly deployed contracts is not increased by interactions with the existing blockchain state. To support this notion, we define local MEV, a novel measure of economic attacks that focusses on the loss of a given set of victim contracts. We study two adversarial models, with bounded and unbounded wealth, and establish sufficient conditions and locality principles that enable modular reasoning about secure composability. We...

论文介绍 本文关注去中心化金融中智能合约组合带来的经济安全风险。引入MEV非干扰形式化概念，定义局部MEV以衡量特定合约的损失。研究有界和无界财富下的敌手模型，建立模块化推理的安全条件，提升DeFi组合的安全性分析。

Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration

第一作者: Cristina Carleo · 方向: 软件安全

代码大语言模型漏洞生成abliterationCWE注入安全对齐隐藏英文摘要

Abstract:Producing a labeled vulnerable code at scale is a recurring obstacle for learning-based vulnerability detection: mined corpora carry substantial label noise, and existing LLM-based augmentation propagates these inaccuracies because it transforms vulnerable seeds rather than synthesising vulnerabilities from a specification. A complementary route is to start from safe code and ask an instruction-tuned LLM to inject a specified CWE (which would shift the labeling burden from open-ended detection to bounded binary confirmation) but safety-aligned code LLMs systematically refuse such prompts. This paper is a preliminary feasibility study of abliteration, a low-rank weight edit that orthogonally projects out the refusal direction in the residual stream, as a tool to remove this barrier. We use Python and CWE-89 (SQL injection) as a case study, evaluating the Qwen2.5-Coder-Instruct...

论文介绍 该研究探讨安全对齐的代码大语言模型在生成漏洞代码时的拒绝问题。通过abliteration技术移除模型中的拒绝方向，以评估其注入指定漏洞的能力。以Python和CWE-89为案例，验证可行性，为漏洞数据合成提供新思路。

From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability

第一作者: Alexandre Cristovão Maiorano · 方向: 软件安全

攻击模拟SIEM规则Sigma规则确定性合成可追溯性隐藏英文摘要

Abstract:Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder. These Breach-and-Attack-Simulation (BAS) tools surface findings, but the security information and event management (SIEM) systems that watch production need detection rules -- and today a human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule (a vendor-neutral detection format). We show this translation can be partially automated when probes are drawn from a locked corpus, so each finding carries a stable identifier back to the originating probe. We describe a deterministic synthesis function that maps each finding to a starter Sigma rule through a small template library (N=23, indexed by categories from the OWASP LLM and Web Top 10), with a back-reference to the originating finding and its MITRE ATT&CK...

论文介绍 针对攻击模拟结果与SIEM检测规则之间手动转换的瓶颈，本文提出确定性合成方法。通过模板库将BAS工具的发现映射为Sigma规则，并引用MITRE ATT&CK，实现检测规则的自动化生成，提高安全运维效率。

Search-Time Contamination in Deep Research Agents: Measuring Performance Inflation in Public Benchmark Evaluation

第一作者: Yongjie Wang · 方向: AI 安全

搜索时间污染深度研究代理基准评估性能膨胀检测算法隐藏英文摘要

Abstract:Public benchmarks enable fair and reproducible evaluation of LLM reasoning, but they become fragile for deep research agents that actively search the web during inference. Such agents may retrieve public benchmark metadata, question context, or even ground-truth answers via web search. This gives rise to Search-Time Contamination (STC), where external retrieval bypasses intended reasoning and inflates measured performance. We systematically study STC in deep research agent evaluation. We define three contamination types with increasing severity, namely Benchmark Metadata Leakage, Question-Context Leakage, and Explicit Answer Leakage, and develop detection algorithms to identify them and quantify their impact on agent performance. Evaluating modern deep research agents on six public benchmarks, we find that STC is widespread and can inflate performance by up to 4%. Our findings...

论文介绍 本文系统研究深度研究代理在公共基准测试中的搜索时间污染问题。定义三种污染类型并开发检测算法，评估发现STC普遍存在，可导致性能膨胀高达4%。强调基准评估的脆弱性，并提出改进方向。

Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming

第一作者: Nicholas Saban · 方向: 系统安全

06/03 09:21

计算机使用代理红队测试提示注入攻击基准评估领域安全隐藏英文摘要

Recent computer-using-agent (CUA) red-teaming papers report prompt-injection attack success rates (ASR) of 42-98%, but these headline numbers cluster on retired models and on the most-vulnerable model in each paper's panel. We ask whether those techniques, reproduced as hand-crafted templates, still work against current frontier CUAs. We release CUA-HandCrafted, a public benchmark of 793 episodes spanning 24 multi-step web tasks, 56 attack templates, 8 attack families, and 4 system-prompt configurations. Against Claude Sonnet 4.6 and GPT-5.4 we measure 0/140 multi-step attack success (Clopper-Pearson 95% upper bound 2.60%); a prompt ablation shows this resistance lives in the model weights. Yet it does not generalize: on a sister coding-agent benchmark (SkillBench), the same weights fall to hand-crafted skill-injection at up to 100%. We argue that the literature's high ASR is largely...

论文介绍 该研究发布基准CUA-HandCrafted，评估前沿计算机使用代理对提示注入攻击的抵抗力。测试显示当前模型在浏览器任务中完全抵抗，但编码任务中易受攻击，揭示安全对齐的领域特异性，质疑高攻击成功率报告。

Beyond Waveform Robustness: Robust Feature-Vocoder Adversarial Attacks on Automatic Speech Recognition

第一作者: Yifan Liao · 方向: AI 安全

自动语音识别对抗攻击特征-声码器自监督学习黑盒攻击隐藏英文摘要

Abstract:Automatic speech recognition (ASR) systems have become widely used for multilingual speech-to-text transcription. Their robustness to adversarial attacks has become an important topic for the community. Existing adversarial attacks directly add adversarial noise to the speech audio. However, prior work has shown that existing adversarial attacks face two limitations: they often transfer poorly to black-box ASR systems and are increasingly mitigated by defenses tailored to input-space perturbations. In this work, we propose a Clean-Referenced Feature-Vocoder Attack, a surrogate-based black-box attack that moves the adversarial search space from raw waveforms to self-supervised learning (SSL) representations. To address the transferability limitation, we perturb more generalizable acoustic-phonetic representations rather than low-level waveform samples, reducing dependence on...

论文介绍 针对语音识别系统对抗攻击转移性差的问题，本文提出特征-声码器攻击。将扰动空间从波形转移到自监督学习表示，提高对黑盒系统的攻击效果。该方法减少对输入空间扰动的依赖，增强攻击的鲁棒性。

Multi-Objective Submodular Maximization with Differential Privacy

第一作者: Ting Hou · 方向: 隐私保护

06/04 10:18

多目标子模最大化差分隐私近似算法隐私保护优化隐藏英文摘要

In this paper, we study multi-objective submodular maximization (MOSM) subject to a cardinality constraint under differential privacy (DP). Specifically, we aim to select a set of at most $k \in \mathbb{Z}_{+}$ elements to maximize the minimum of $d > 1$ monotone submodular functions while satisfying $\varepsilon$-DP. Although extensive studies have been conducted on both differentially private single-objective submodular maximization on sensitive data and non-private MOSM, to the best of our knowledge, there has not yet been any prior work on MOSM with DP. We propose two novel algorithms: the first extends the classic greedy algorithm and the second employs a truncation technique, both of which are integrated with DP mechanisms for privacy protection and achieve approximation guarantees for MOSM. Finally, we conduct numerical experiments on two submodular maximization applications...

论文介绍 本文研究差分隐私约束下的多目标子模最大化问题。目标是选择元素集以最大化多个单调子模函数的最小值。提出两种算法：扩展贪心和截断技术，集成差分隐私机制，并提供近似保证，应用于实际优化场景。

GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection

第一作者: Paulo Ricardo Ferreira Neves · 方向: AI 安全

大语言模型安全提示注入攻击越狱攻击检测轻量级神经网络集成学习隐藏英文摘要

Abstract:Large Language Models (LLMs) have transformed natural language processing, but they remain vulnerable to Prompt Injection (PI) and Jailbreak (JB) attacks. In addition, benchmark evaluations may be affected by contamination and partial information leakage, compromising performance estimates. This work presents GuardNet, a guardrail system based on an ensemble of shallow neural networks (BiLSTMs) with approximately 47 million parameters. We investigate the hypothesis that robustness in adversarial scenarios depends more on the diversity of example coverage and threshold calibration than on model scale. The results indicate that GuardNet achieves competitive performance compared with lightweight detectors and high efficiency at low latency, although larger LLMs such as Mistral-7B and Llama-3.1-8B still achieve superior performance in terms of F1 score and AUROC on the blind...

论文介绍 该研究聚焦于大语言模型面临的提示注入与越狱攻击问题，并提出一种名为 GuardNet 的防御系统。该系统基于约4700万参数的 BiLSTM 集成模型构建，旨在验证其核心假设：在对抗场景下，系统的鲁棒性更多依赖于样本覆盖的多样性和阈值校准，而非模型规模。实验表明，该系统在低延迟下实现了具有竞争力的检测效率，为轻量化安全防线提供了可行方案。

On the Cryptographic Structure Required for Verifying Qubits

第一作者: James Bartusek · 方向: 密码学协议

量子计算验证密码学假设非对易性测试经典通信密钥交换隐藏英文摘要

Abstract:Classically testing for the presence of anti-commuting operators on a quantum device is a critical tool underpinning recent progress in classical verification of quantum computation. While such tests can be based on cryptographic assumptions, known constructions rely on highly structured assumptions, e.g. trapdoor claw-free functions. In this work, we seek to explain this state of affairs by constructing strong cryptography from (certain forms of) classical tests of anti-commutation. In particular, we formulate the notion of a test of non-commutation (ToNC), an interactive protocol between a quantum prover and classical verifier in which the prover's final-round response is obtained by measuring one of two binary observables $P_0,P_1$ depending on the verifier's challenge bit $c$. We prove that, for a broad range of parameters, ToNC implies classical-communication key...

论文介绍 本文探讨了在量子设备上测试反交换算子存在性所需的基础密码学结构。研究者提出了一个非对易性测试（ToNC）的形式化协议，其中量子证明者的响应取决于对某个二元可观测量的测量。他们证明，对于广泛的参数范围，该测试本身蕴含了构造经典通信密钥交换方案的能力，从而为已有高度结构化假设的验证方法提供了更一般的理论基础。

DP-MacAdam: Differentially Private Mechanism with Adaptive Clipping and Adaptive Momentum

第一作者: Naima Tasnim · 方向: AI 安全

差分隐私自适应裁剪动量优化隐私保护机器学习DP-SGD隐藏英文摘要

Abstract:Differentially private stochastic gradient descent (DP-SGD) has become the standard framework for privacy-preserving machine learning, yet its reliance on a fixed gradient clipping threshold to limit sensitivity remains a significant practical limitation. Adaptive clipping algorithms such as AdaClip shift and scale the gradient prior to clipping and adding noise so that the clipped gradient yields a more informative descent direction. The shift and scaling parameters are selected adaptively based on the empirical mean and variance. However, in existing adaptive clipping algorithms, these empirical estimates have not been also used for momentum to accelerate training itself. On the other hand, DP-Adam is an algorithm that exploits Adam-like momentum updates based on the gradient mean and variance to accelerate training, but does not exploit these estimates for adaptive...

论文介绍 针对隐私保护机器学习中 DP-SGD 依赖固定梯度裁剪阈值的局限，本文提出了 DP-MacAdam 机制。该方法的核心创新在于将自适应裁剪中基于梯度均值和方差的估计值，同时用于梯度缩放与 Adam 风格的动量更新，从而在保持差分隐私的前提下，试图自适应地优化梯度方向并加速模型训练过程。