2026-06-07

GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation

第一作者: Linard Arquint · 方向: 软件安全

密码学实现形式化验证Go语言RSA密钥生成隐藏英文摘要

Abstract:We verify the 'extendedGCD' implementation in Go's standard library ('crypto/internal/fips140/bigmod'), which plays a crucial role in the generation of RSA key pairs. Even though the Go implementation is supposedly a direct port from BoringSSL's implementation, we uncovered two deviations that each break the algorithm's invariants: (1) the Go implementation deviates in the way coefficients are updated, and (2) it permits a larger input domain. We address both deviations; the first by fixing the Go implementation, which results in an on average 24% speedup, and the second deviation by porting an existing proof for BoringSSL and extending it to cover the larger input domain. We prove correctness and termination of the fixed Go implementation using Gobra, a deductive program verifier for Go. Where necessary, we used Lean to prove key lemmata on non-linear arithmetic, which we...

论文介绍 Go标准库中用于RSA密钥生成的扩展欧几里得算法实现被发现存在偏差。本文利用Gobra验证器对该实现进行形式化验证，发现了两处破坏算法不变性的偏差：一处是系数更新方式，另一处是允许了更大的输入域。研究者修复了第一个偏差（带来了平均24%的性能提升），并将现有证明扩展以覆盖更大的输入域，最终证明了修复后实现的正确性与终止性。

SentinelRAG: Synthetic Sentinel Knowledge for RAG Database Copyright Protection

第一作者: Tsun On Kwok · 方向: AI 安全

RAG数据库版权保护水印合成知识检测隐藏英文摘要

Abstract:Protecting proprietary RAG databases from unauthorized redistribution is challenging: existing watermarking methods either inject fabricated relations between real entities, polluting the knowledge base with misinformation, or embed fragile lexical patterns that adversarial paraphrasing easily removes. We propose SentinelRAG, a watermarking framework that embeds style-consistent but fictitious knowledge entries into the RAG database. Our key insight is that synthetic knowledge describing fictitious entities is unlikely to be retrieved by legitimate queries, yet can be reliably triggered through targeted probes known only to the data owner. Experiments on four datasets ranging from 2.9k to 8.8M documents demonstrate that SentinelRAG achieves statistically significant detection $p < 10^{-5}$ across all tested configurations at only a 0.1% injection rate. Compared to the...

论文介绍 针对RAG数据库版权保护的挑战，现有水印方法易污染知识库或易被移除。本文提出SentinelRAG水印框架，通过嵌入风格一致但虚构的知识条目，实现可靠检测。该方法基于合成知识不易被合法查询检索但可通过专用探测触发的原理，实验显示在仅0.1%注入率下有效检测，适用于防止数据库未授权分发。

TinyML-Driven Cybersecurity for Autonomous Spacecraft: Latency-Accuracy Analysis for SPARTA RF and Cyber Threat Detection

第一作者: Van Le · 方向: AI 安全

TinyML航天器网络安全延迟-准确性权衡SPARTA模型威胁检测隐藏英文摘要

Abstract:Autonomous spacecraft require rapid, lightweight, and reliable onboard detection of cyber-RF threats. Using the SPARTA attack model, we analyze the latency-accuracy trade-offs of TinyML-compatible classical models -- Random Forest, Logistic Regression, SVM, and MLP -- for detecting uplink jamming, Fake-NR spoofing, payload manipulation, ground-segment compromise, and unauthorized command injection. We present a physics-informed theoretical analysis of each model's computational complexity, VC dimension, Lipschitz continuity, and latency scaling, supported by empirical measurements on adversarial RF spectrograms generated via BandErasure, FakeNR, and NoiseBurst corruption modes. Results show that Logistic Regression achieves microsecond-level inference with only a 1\% accuracy drop relative to Random Forest, making it an effective TinyML baseline for onboard autonomy. The study...

论文介绍 本文研究自主航天器的网络安全检测，聚焦于延迟与准确性的权衡。使用SPARTA攻击模型，分析TinyML兼容模型如随机森林、逻辑回归等在检测多种威胁时的性能。理论分析和实验结果表明逻辑回归在保持高准确性的同时实现微秒级推理，为航天器在轨自主系统提供轻量级实时威胁检测方案。

An Improved CNN-LSTM Based Intrusion Detection System for IoT Networks

第一作者: Mohammad Tariq Ikhlas · 方向: AI 安全

物联网入侵检测CNN-LSTM深度学习网络安全隐藏英文摘要

Abstract:With the rapid proliferation of IoT devices, security concerns have dramatically escalated and intrusion detection systems have become critical for protecting networked environments. This paper presents an improved CNN-LSTM based intrusion detection model that combines multi-class classification, dataset integration, and temporal feature learning to enhance detection performance in IoT networks. Using network traffic data, the proposed approach is evaluated on intrusion detection tasks and achieves an accuracy of approximately 97%. Experimental results demonstrate that the model effectively detects multiple attack categories while maintaining stable training and validation performance. The integration of convolutional and recurrent neural network components enables the framework to capture both spatial and temporal characteristics of network traffic, improving overall...

论文介绍 针对物联网网络安全，本文提出一种改进的CNN-LSTM入侵检测模型。该模型整合多类分类和时间特征学习，结合卷积和循环神经网络，有效捕获网络流量的空间和时间特性。实验评估显示准确率约97%，能稳定检测多种攻击类别，为物联网安全防护提供新方法。

Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense

第一作者: Minseok Choi · 方向: AI 安全

大型语言模型安全对齐越狱防御对比学习自演化记忆隐藏英文摘要

Abstract:Despite advances in safety alignment, large language models remain vulnerable to continuously evolving jailbreaks. Existing fine-tuned safety classifiers cannot adapt to these evolving attacks, while adaptive memory-based guardrails tend to over-refuse benign queries that resemble stored attacks. We propose Membrane, a self-evolving guardrail built on Contrastive Safety Memory (CSM): each cell pairs the conditions for blocking a harmful query with those for permitting a superficially similar benign request. Without retraining, Membrane evolves CSM by distilling each harmful interaction and its benign counterpart into a contrastive cell indexed by the underlying attack strategy, so that one cell generalizes across topical variants of the same mechanism. At inference, retrieved cells serve as grounding context for precise safety decisions. Across model-level safety on HarmBench...

论文介绍 本文提出Membrane，一种自演化对比安全记忆框架，用于防御LLM的越狱攻击。它通过将有害与良性查询条件配对，无需重新训练即可适应新攻击模式。该方法在推理时利用检索的对比单元进行精准安全决策，增强LLM的安全性，减少误拒良性查询。

An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic

第一作者: Shuze Liu · 方向: AI 安全

06/04 13:33

模型提取攻击LLM API异常检测流量监控最大均值差异隐藏英文摘要

Large language models (LLMs) are increasingly deployed through hosted APIs, making model extraction a practical threat to model ownership and service security. However, individual extraction queries often resemble benign requests, and existing evaluations often focus on single-query anomaly scoring or pure benign-versus-attacker user settings. We formulate model extraction monitoring as benign-calibrated traffic-window distribution testing and show that an embarrassingly simple detector is effective: embed incoming queries into a semantic space and test whether their aggregate distribution deviates from historical benign traffic. We instantiate the detector with maximum mean discrepancy (MMD), using only benign-vs-benign comparisons to set the decision threshold. We evaluate on fourteen attacker-normal query pairs from four extraction scenarios and compare with adapted PRADA, SEAT...

论文介绍 针对LLM API中的模型提取威胁，本文提出一种简单的检测器。通过将查询嵌入语义空间并测试聚合分布是否偏离历史良性流量，使用最大均值差异设置决策阈值。该方法基于良性校准的流量窗口分布测试，实验表明在多个提取场景下有效，为API安全监控提供实用方案。

Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection and Prevention in U.S. Critical Digital Infrastructure: A Comparative Machine Learning Evaluation on CSE-CIC-IDS2018

第一作者: Md. Iqbal Hossan · 方向: 密码学协议

关键基础设施网络安全CNN-LSTM机器学习入侵检测隐藏英文摘要

Abstract:Digital infrastructure is growing at a rapid pace in the United States, and as a result, exposure to advanced cyber threats to critical sectors including healthcare, finance, transportation, energy and government systems is growing. The traditional cybersecurity approaches, including signature-based intrusion detection systems, have become less effective against today's cyber attacks, as they are unable to detect unknown and changing attacks in real time. To overcome these constraints, this research suggests a smart cyber-defense system, which utilizes Artificial Intelligence (AI) and Machine Learning (ML) algorithms in the detection and prevention of cyber attacks in the U.S. digital infrastructure. This study uses the CSE-CIC-IDS2018 dataset, which is a realistic network traffic dataset, along with various cyber attack scenarios, including Distributed Denial of Service...

论文介绍 本文针对美国关键数字基础设施的网络安全挑战，提出一种混合CNN-LSTM框架。该系统利用人工智能和机器学习算法，在CSE-CIC-IDS2018数据集上评估，旨在智能检测和预防网络攻击，克服传统签名基方法的局限，提升对未知威胁的实时检测能力。

Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework

第一作者: B. M. Taslimul Haque · 方向: 系统安全

可解释AI网络安全XGBoostSHAP关键基础设施治理隐藏英文摘要

Abstract:The increasing penetrations of the critical infrastructure sector in the United States with intelligent digital technologies have greatly increased exposure to advanced cyber adversaries and operational vulnerabilities. AI-powered governance and automated decision-making systems are becoming a key part of the operation of critical infrastructure systems, including energy, healthcare, transportation, financial services, and communication infrastructure, in order to improve efficiency and strategic management. The growing cyber threat environment, such as Distributed Denial of Service (DDos) attacks, botnets, ransomware, and Advanced Persistent Threats (APTs) pose significant challenges to infrastructure resilience, cyber security reliability, and governance trustworthiness. In a changing attack landscape and dynamic network environment, traditional cybersecurity mechanisms can...

论文介绍 本文提出一种基于XGBoost和SHAP的可解释AI框架，用于美国关键基础设施的网络安全风险分析和治理。该框架旨在增强入侵检测的模型可靠性和决策透明度，支持智能治理应对复杂网络威胁，如DDoS攻击和APT。

Cognitive Threat Intelligence and Explainable Federated Security Analytics for distributed Infrastructure Systems

第一作者: Md. Arifur Rahman · 方向: AI 安全

06/04 12:41

联邦学习可解释AI威胁情报分布式系统网络安全隐藏英文摘要

The increasing adoption of distributed infrastructure systems, cloud computing, Internet of Things (IoT) technologies, and edge-based architectures has significantly expanded the cybersecurity attack surface and introduced increasingly sophisticated cyber threats. Conventional centralized intrusion detection approaches often face challenges related to scalability, data privacy, communication overhead, and limited transparency in artificial intelligence-driven decision-making processes. To address these limitations, this study proposes a Cognitive Threat Intelligence and Explainable Federated Security Analytics framework for distributed infrastructure systems. The proposed framework integrates Federated Learning (FL), Explainable Artificial Intelligence (XAI), and cognitive cybersecurity analytics to enable collaborative and privacy-preserving cyber threat detection across distributed...

论文介绍 针对分布式基础设施系统的网络安全挑战，本文提出一个认知威胁情报和可解释联邦安全分析框架。该框架整合联邦学习、可解释AI和认知网络安全分析，以解决集中式方法的可扩展性和隐私问题，实现跨分布式系统的协作和隐私保护威胁检测。

Protecting K-Nearest Neighbor Queries from Location Inference Attacks

第一作者: Zhiyu Sun · 方向: 隐私保护

k近邻查询位置隐私差分隐私几何交集攻击拒绝采样隐藏英文摘要

Abstract:The k-nearest neighbor query (kNNQ) is a core component of modern location-based services (LBS) and has been widely adopted in popular features such as ``people nearby''. However, its potential privacy risks have long been overlooked. In this work, we present the first two attacks against kNNQ, namely the geometric intersection location inference attack (GI-LIA) and the zero-order optimization location inference attack (ZO-LIA), revealing the inherent location privacy risks posed by kNNQ. To mitigate these privacy risks, we further propose DPRS, a differential privacy framework for kNNQ protection. The core idea of DPRS is to incorporate a rejection sampling mechanism within a constrained perturbation interval, thereby mitigating the distance distortion caused by excessive noise injection. In addition, we design a private interval construction algorithm to construct the...

论文介绍 该研究首次揭示了基于k近邻查询（kNNQ）的位置服务中存在的位置隐私风险，提出了两种推理攻击方法。为保护用户隐私，论文提出了一个名为DPRS的差分隐私框架，其核心在于结合约束扰动区间内的拒绝采样机制，以减少过度噪声注入导致的距离失真，为提升LBS的安全性提供了新的解决方案。

SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks

第一作者: Seungwon Jeong · 方向: AI 安全

大语言模型越狱攻击位置漏洞贪心坐标梯度脆弱插槽评分隐藏英文摘要

Abstract:As large language models (LLMs) are widely deployed, identifying their vulnerability through jailbreak attacks becomes increasingly critical. Optimization-based attacks like Greedy Coordinate Gradient (GCG) have focused on inserting adversarial tokens to the end of prompts. However, GCG restricts adversarial tokens to a fixed insertion point (typically the prompt suffix), leaving the effect of inserting tokens at other positions unexplored. In this paper, we empirically investigate \emph{slots}, i.e., candidate positions within a prompt where tokens can be inserted. We find that vulnerability to jailbreaking is highly related to the selection of the \emph{slots}. Based on these findings, we introduce the \textit{Vulnerable Slot Score} (VSS) to quantify the positional vulnerability to jailbreaking. We then propose SlotGCG, which evaluates all slots with VSS, selects the most...

论文介绍 本文研究大语言模型（LLMs）在提示词不同位置插入对抗性令牌的脆弱性。研究发现漏洞与插入位置（插槽）高度相关，并提出了脆弱插槽评分（VSS）来量化位置漏洞。基于此，论文引入SlotGCG方法，通过评估和选择最脆弱的插槽来优化越狱攻击，揭示了现有优化攻击的局限性。

The Coverage Gap: Chile's Cyber Disclosure Framework versus the USA, EU and UK

第一作者: David Mellafe Z · 方向: 安全研究

06/04 10:17

网络安全漏洞披露覆盖差距关键基础设施OSINT隐藏英文摘要

We introduce the Coverage Gap as a measurable distance between the observable public exposure of critical-infrastructure operators and their declared capability to coordinate vulnerability disclosure. We instantiate it against the 915 Chilean Operadores de Importancia Vital (OIVs -- Operators of Vital Importance) designated by the National Cybersecurity Agency (ANCI) under Ley 21.663 (Resolucion Exenta No. 87, 16 December 2025). Using a passive-only, OSINT-based method consistent with the principles of ISO/IEC 29147:2018 and Chile's computer-crimes safe harbour (Ley 21.459), we conduct a full-universe census of the foundational disclosure-capability layer (Layer 1, verifiable disclosure contact) across approximately 98.7% of the official catalogue. Only 16 of 915 OIVs (1.7%) publish a verifiable RFC 9116 disclosure channel; among operators of physical-world infrastructure -- energy...

论文介绍 论文提出“覆盖差距”概念，以衡量关键基础设施运营商的公开暴露面与其协调漏洞披露能力之间的差距。研究以智利915个“重要运营商”（OIVs）为对象，基于OSINT方法进行普查，发现仅1.7%的运营商建立了可验证的披露通道。该工作通过量化分析，指出了网络披露框架在实践中的不足。

Dimensionality Reduction for Cyberattack Classification: A Comparative Evaluation of PCA and Linear Predictive Coding

第一作者: Nelly Elsayed · 方向: AI 安全

网络安全降维主成分分析线性预测编码特征压缩隐藏英文摘要

Abstract:High-dimensional feature representations are widely used in machine learning-based cyberattack detection systems. However, they increase computational complexity and may hinder deployment in resource-constrained environments. In this paper, we investigate feature compression techniques for cyberattack classification by comparing two dimensionality reduction approaches: Principal Component Analysis (PCA) and Linear Predictive Coding (LPC). Compressed feature representations with varying dimensionalities are generated and evaluated across several classification models. Experimental analysis demonstrates that PCA preserves classification performance even under aggressive compression. On the other hand, LPC provides competitive predictive representations with slightly larger performance degradation. The results show that substantial reductions in feature dimensionality can be...

论文介绍 为应对机器学习网络攻击检测系统中高维特征带来的计算复杂度问题，本文比较了主成分分析（PCA）和线性预测编码（LPC）两种降维技术在攻击分类中的表现。实验表明，PCA在激进压缩下仍能保持分类性能，而LPC则以轻微的性能下降为代价提供了有竞争力的特征表示，为在资源受限环境中部署检测系统提供了依据。

ZERO-APT: A Closed-Loop Adversarial Framework for LLM-Driven Automated Penetration Testing under Intelligent Defense

第一作者: Anlan Zheng · 方向: AI 安全

自动化渗透测试大语言模型对抗框架闭环可审计性隐藏英文摘要

Abstract:LLM-driven automated penetration testing agents are typically evaluated against static targets that neither detect nor respond to attacks, so their behavior under intelligent defense remains untested. The causal consistency of multi-step attack chains likewise hinges on unstable LLM reasoning, and agent decisions remain opaque to human analysts. These three shortcomings, in realism, consistency, and auditability, are usually patched in isolation. We present ZERO-APT, a turn-based attacker-defender-judge framework that addresses them within a single architecture. For realism, ZERO-APT embeds a configurable LLM Defender that consumes Sysmon telemetry and detects attacks in real time, exposing the attacker to a live opponent rather than a passive target. For consistency, three architectural mechanisms move causal consistency from unstable LLM reasoning into enforced system...

论文介绍 现有LLM驱动的自动化渗透测试智能体通常在静态目标上评估，缺乏真实性、一致性和可审计性。ZERO-APT提出了一个基于回合制的攻击者-防御者-裁判框架。该框架通过引入可配置的LLM防御者实时检测攻击以提升真实性，通过系统化机制确保攻击链的因果一致性，并记录决策过程以增强可审计性。

Bitcoin After Block Rewards

第一作者: Junhyuk Lee · 方向: 密码学协议

比特币区块奖励交易费矿工博弈协议机制隐藏英文摘要

Abstract:Bitcoin's block reward is scheduled to decline to zero, raising concerns about whether the network can remain secure once miners rely solely on transaction fees. This paper seeks to identify the conditions under which large-scale and persistent deviation from honest mining can arise. We analyze and compare the payoffs of honest and deviating miners in a sequential decision model, and identify a deviation threshold $G_t$ at which honest mining ceases to be privately optimal. Around the 2024 Bitcoin halving, we show that current mining behavior does not exhibit large-scale or structural deviation. However, when the block reward is removed, the $G_t$ criterion implies that deviation can arise even with a very small fraction of transaction fees. Finally, we evaluate three protocol-level mechanisms: Base Fee, Fee Floor, and an adaptive maximum block size rule, and show that their...

论文介绍 本文研究比特币区块奖励最终归零后，网络仅依赖交易费时的安全性问题。通过构建序贯决策模型，论文分析了诚实挖矿与偏离行为的收益，并识别出使诚实挖矿不再是最优策略的偏离阈值。分析表明，仅靠交易费时，即使很小的费用比例也可能引发偏离。论文进一步评估了基础费用、费用下限等三种协议级机制。

SHIELDS: Automating OS Hardening with Iterative Multi-Agent Remediation

第一作者: Andrew Hamara · 方向: 系统安全

06/04 05:54

操作系统加固安全合规多智能体系统大语言模型迭代修复隐藏英文摘要

Security misconfigurations remain a leading cause of OS-level compromise, and manually keeping systems compliant with standards like Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) is a tedious and expensive process. Existing compliance automation tools can reduce some of this burden, but they depend on static, pre-written corrective actions. In this paper, we introduce SHIELDS, a multi-agent system that uses large language models (LLMs) to approach OS hardening as an iterative, feedback-driven process. Instead of applying fixed remediations, SHIELDS continuously proposes fixes and refines them based on feedback from target system execution and validation scans. We evaluate the system across multiple virtual machine configurations using six contemporary LLMs ranging from 20B to 400B parameters, and find that SHIELDS successfully remediates up...

论文介绍 针对操作系统安全合规手动操作繁琐且现有自动化工具依赖静态修复脚本的问题，本文提出了SHIELDS系统。该系统将大语言模型（LLMs）作为多智能体，将操作系统加固视为一个迭代、反馈驱动的过程。系统根据目标系统的执行反馈和扫描结果持续提出并优化修复方案，实验证明其能有效修复安全错误配置。

CRESS: Quantifying Vulnerabilities of Attack Scenarios in Hardware Reverse Engineering

第一作者: Alexander Hepp · 方向: 系统安全

硬件安全逆向工程漏洞量化供应链安全评分系统隐藏英文摘要

Abstract:The safety, security, and reliability of microelectronic systems depend on a trustworthy, secured supply chain and design flow. Globally distributed supply chains or unintentional design weaknesses leave the door open for attacks on the hardware level. These scenarios encompass counterfeiting, hardware trojans, or on-device attacks. For these, hardware reverse engineering (RE) results play a pivotal role. The ongoing publication of new RE-involved attacks motivated the development of the common RE scoring system (CRESS). The system enables a general classification of RE-involved scenarios for a common, consistent rating. In this work, the originally qualitative system is extended to a quantitative system. We performed an extensive interview study with experts in the field. The interview results allowed us to derive weights that measure the severity of different RE-involved...

论文介绍 硬件逆向工程（RE）在评估硬件安全威胁（如芯片克隆、硬件木马）中至关重要。本文将先前定性的通用逆向工程评分系统（CRESS）扩展为定量系统。通过一项广泛的专家访谈研究，论文为不同RE相关场景的严重性赋予了权重，从而能够对攻击场景进行量化评分和比较，为硬件供应链风险评估提供了更精确的工具。

Policy-Compliant Cloud Storage Systems

第一作者: Dimitrios Stavrakakis · 方向: 软件安全

GDPR合规云存储键值存储可信中间件机密虚拟机隐藏英文摘要

Abstract:Privacy regulations such as the General Data Protection Regulation (GDPR) impose strict requirements on how personal data is stored, processed, and audited. While key-value stores (KVS) are widely used in latency-sensitive applications, their simple data model and untrusted cloud deployment environments make GDPR compliance particularly challenging. Existing approaches require invasive code modifications, impose high performance overheads, or overlook the integrity of compliance mechanisms themselves. This paper presents GDPRuler, a trusted middleware system that enables verifiable GDPR compliance for KVS on untrusted clouds without modifying their codebase. GDPRuler deploys a trusted GDPR monitor inside a Confidential Virtual Machine (CVM), which enforces GDPR policies, manages compliance metadata, and maintains tamper-evident audit logs. A declarative policy language...

论文介绍 该研究针对不受信任云环境中键值存储系统的GDPR合规挑战，提出了GDPRuler可信中间件系统。该系统在机密虚拟机中部署GDPR监视器，强制执行策略、管理合规元数据并维护防篡改审计日志，从而在不修改代码库的情况下实现可验证的合规性。这为云存储隐私保护提供了可行方案。

A formal framework for the economic security of DeFi compositions

第一作者: Massimo Bartoletti · 方向: AI 安全

去中心化金融经济安全最大可提取价值智能合约形式化框架隐藏英文摘要

Abstract:Decentralized Finance (DeFi) services are usually constructed by composing a variety of smart contracts. While composability is a key driver of the success of DeFi, it also creates security risks: adversaries may exploit interactions between newly deployed contracts and the pre-existing ones to inflict economic losses. We introduce MEV non-interference, a formal security notion for DeFi composability requiring that the maximal extractable value from a set of newly deployed contracts is not increased by interactions with the existing blockchain state. To support this notion, we define local MEV, a novel measure of economic attacks that focusses on the loss of a given set of victim contracts. We study two adversarial models, with bounded and unbounded wealth, and establish sufficient conditions and locality principles that enable modular reasoning about secure composability. We...

论文介绍 本文针对去中心化金融（DeFi）组合中的经济安全风险，引入MEV非干扰形式化概念，要求新部署合约的最大可提取价值不因与现有区块链状态交互而增加。通过定义局部MEV度量和研究对手模型，为模块化推理安全组合提供充分条件，有助于指导DeFi系统设计。

Willing but Unable: Separating Refusal from Capability in Code LLMs via Abliteration

第一作者: Cristina Carleo · 方向: 软件安全

代码大语言模型漏洞检测ablation安全对齐拒绝能力隐藏英文摘要

Abstract:Producing a labeled vulnerable code at scale is a recurring obstacle for learning-based vulnerability detection: mined corpora carry substantial label noise, and existing LLM-based augmentation propagates these inaccuracies because it transforms vulnerable seeds rather than synthesising vulnerabilities from a specification. A complementary route is to start from safe code and ask an instruction-tuned LLM to inject a specified CWE (which would shift the labeling burden from open-ended detection to bounded binary confirmation) but safety-aligned code LLMs systematically refuse such prompts. This paper is a preliminary feasibility study of abliteration, a low-rank weight edit that orthogonally projects out the refusal direction in the residual stream, as a tool to remove this barrier. We use Python and CWE-89 (SQL injection) as a case study, evaluating the Qwen2.5-Coder-Instruct...

论文介绍 本文研究安全对齐的代码大语言模型（LLMs）在漏洞注入任务中的拒绝行为，通过ablation技术正交投影移除拒绝方向，使模型能生成指定漏洞（如SQL注入）。这为从安全代码合成漏洞数据提供了初步可行性，可能改进基于学习的漏洞检测方法。

From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability

第一作者: Alexandre Cristovão Maiorano · 方向: 软件安全

攻击模拟安全信息和事件管理规则Sigma规则自动化合成检测即代码隐藏英文摘要

Abstract:Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder. These Breach-and-Attack-Simulation (BAS) tools surface findings, but the security information and event management (SIEM) systems that watch production need detection rules -- and today a human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule (a vendor-neutral detection format). We show this translation can be partially automated when probes are drawn from a locked corpus, so each finding carries a stable identifier back to the originating probe. We describe a deterministic synthesis function that maps each finding to a starter Sigma rule through a small template library (N=23, indexed by categories from the OWASP LLM and Web Top 10), with a back-reference to the originating finding and its MITRE ATT&CK...

论文介绍 本文解决攻击模拟工具与安全信息和事件管理（SIEM）规则生成之间的自动化鸿沟。提出确定性合成函数，通过模板库将攻击发现映射为Sigma规则，并利用探针级可追溯性确保一致性。这有助于提高安全监控的效率和检测规则的准确性。

Search-Time Contamination in Deep Research Agents: Measuring Performance Inflation in Public Benchmark Evaluation

第一作者: Yongjie Wang · 方向: AI 安全

深度研究代理基准评估搜索时间污染性能膨胀大语言模型推理隐藏英文摘要

Abstract:Public benchmarks enable fair and reproducible evaluation of LLM reasoning, but they become fragile for deep research agents that actively search the web during inference. Such agents may retrieve public benchmark metadata, question context, or even ground-truth answers via web search. This gives rise to Search-Time Contamination (STC), where external retrieval bypasses intended reasoning and inflates measured performance. We systematically study STC in deep research agent evaluation. We define three contamination types with increasing severity, namely Benchmark Metadata Leakage, Question-Context Leakage, and Explicit Answer Leakage, and develop detection algorithms to identify them and quantify their impact on agent performance. Evaluating modern deep research agents on six public benchmarks, we find that STC is widespread and can inflate performance by up to 4%. Our findings...

论文介绍 本文系统研究深度研究代理在公共基准评估中的搜索时间污染问题，即代理通过网络搜索检索基准元数据或答案，导致性能膨胀。定义三种污染类型并开发检测算法，在六个基准上量化影响。这强调了评估公平性并提供污染缓解参考。

Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming

第一作者: Nicholas Saban · 方向: 系统安全

06/03 09:21

计算机使用代理安全性提示注入基准测试红队测试隐藏英文摘要

Recent computer-using-agent (CUA) red-teaming papers report prompt-injection attack success rates (ASR) of 42-98%, but these headline numbers cluster on retired models and on the most-vulnerable model in each paper's panel. We ask whether those techniques, reproduced as hand-crafted templates, still work against current frontier CUAs. We release CUA-HandCrafted, a public benchmark of 793 episodes spanning 24 multi-step web tasks, 56 attack templates, 8 attack families, and 4 system-prompt configurations. Against Claude Sonnet 4.6 and GPT-5.4 we measure 0/140 multi-step attack success (Clopper-Pearson 95% upper bound 2.60%); a prompt ablation shows this resistance lives in the model weights. Yet it does not generalize: on a sister coding-agent benchmark (SkillBench), the same weights fall to hand-crafted skill-injection at up to 100%. We argue that the literature's high ASR is largely...

论文介绍 本文评估前沿计算机使用代理对提示注入攻击的安全性，发布793集浏览器基准（CUA-HandCrafted）和编码域交叉引用。测试显示当前模型对多步攻击具有高抵抗力，但安全能力不泛化到其他域。这审计了红队测试的可重复性并揭示领域条件安全差异。

Beyond Waveform Robustness: Robust Feature-Vocoder Adversarial Attacks on Automatic Speech Recognition

第一作者: Yifan Liao · 方向: AI 安全

自动语音识别对抗性攻击特征-vocoder攻击转移性鲁棒性隐藏英文摘要

Abstract:Automatic speech recognition (ASR) systems have become widely used for multilingual speech-to-text transcription. Their robustness to adversarial attacks has become an important topic for the community. Existing adversarial attacks directly add adversarial noise to the speech audio. However, prior work has shown that existing adversarial attacks face two limitations: they often transfer poorly to black-box ASR systems and are increasingly mitigated by defenses tailored to input-space perturbations. In this work, we propose a Clean-Referenced Feature-Vocoder Attack, a surrogate-based black-box attack that moves the adversarial search space from raw waveforms to self-supervised learning (SSL) representations. To address the transferability limitation, we perturb more generalizable acoustic-phonetic representations rather than low-level waveform samples, reducing dependence on...

论文介绍 本文针对自动语音识别（ASR）系统对抗性攻击的转移性和鲁棒性限制，提出Clean-Referenced Feature-Vocoder黑盒攻击方法。该方法将对抗搜索空间从波形转移到自监督学习表示，扰动更具泛化性的声学语音特征，以增强攻击在不同系统间的转移能力。

Multi-Objective Submodular Maximization with Differential Privacy

第一作者: Ting Hou · 方向: 隐私保护

06/04 10:18

多目标优化子模最大化差分隐私近似算法隐私保护隐藏英文摘要

In this paper, we study multi-objective submodular maximization (MOSM) subject to a cardinality constraint under differential privacy (DP). Specifically, we aim to select a set of at most $k \in \mathbb{Z}_{+}$ elements to maximize the minimum of $d > 1$ monotone submodular functions while satisfying $\varepsilon$-DP. Although extensive studies have been conducted on both differentially private single-objective submodular maximization on sensitive data and non-private MOSM, to the best of our knowledge, there has not yet been any prior work on MOSM with DP. We propose two novel algorithms: the first extends the classic greedy algorithm and the second employs a truncation technique, both of which are integrated with DP mechanisms for privacy protection and achieve approximation guarantees for MOSM. Finally, we conduct numerical experiments on two submodular maximization applications...

论文介绍 本文研究在差分隐私约束下的多目标子模最大化问题，旨在选择有限元素集以最大化多个单调子模函数的最小值。提出扩展贪心算法和截断技术两种隐私保护算法，并实现近似保证。这为隐私敏感的组合优化应用提供了新方法。

GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection

第一作者: Paulo Ricardo Ferreira Neves · 方向: AI 安全

提示注入攻击越狱攻击浅层神经网络集成防护系统对抗鲁棒性隐藏英文摘要

Abstract:Large Language Models (LLMs) have transformed natural language processing, but they remain vulnerable to Prompt Injection (PI) and Jailbreak (JB) attacks. In addition, benchmark evaluations may be affected by contamination and partial information leakage, compromising performance estimates. This work presents GuardNet, a guardrail system based on an ensemble of shallow neural networks (BiLSTMs) with approximately 47 million parameters. We investigate the hypothesis that robustness in adversarial scenarios depends more on the diversity of example coverage and threshold calibration than on model scale. The results indicate that GuardNet achieves competitive performance compared with lightweight detectors and high efficiency at low latency, although larger LLMs such as Mistral-7B and Llama-3.1-8B still achieve superior performance in terms of F1 score and AUROC on the blind...

论文介绍 该研究针对大语言模型易受提示注入和越狱攻击的问题，提出了一个名为 GuardNet 的防护系统。该系统基于参数量约 4700 万的双向长短时记忆网络集成构建。研究探讨了在对抗场景中，示例覆盖的多样性和阈值校准比模型规模对鲁棒性影响更大的假设。结果表明，GuardNet 在低延迟下实现了有竞争力的检测效率，可用于构建实时安全护栏。

On the Cryptographic Structure Required for Verifying Qubits

第一作者: James Bartusek · 方向: 密码学协议

量子比特验证非对易性测试密码学协议经典验证密钥交换隐藏英文摘要

Abstract:Classically testing for the presence of anti-commuting operators on a quantum device is a critical tool underpinning recent progress in classical verification of quantum computation. While such tests can be based on cryptographic assumptions, known constructions rely on highly structured assumptions, e.g. trapdoor claw-free functions. In this work, we seek to explain this state of affairs by constructing strong cryptography from (certain forms of) classical tests of anti-commutation. In particular, we formulate the notion of a test of non-commutation (ToNC), an interactive protocol between a quantum prover and classical verifier in which the prover's final-round response is obtained by measuring one of two binary observables $P_0,P_1$ depending on the verifier's challenge bit $c$. We prove that, for a broad range of parameters, ToNC implies classical-communication key...

论文介绍 该研究旨在解释经典验证量子计算中依赖的特定密码学结构。论文定义并形式化了「非对易性测试」协议，即一个量子证明者与经典验证者之间的交互协议，证明者的响应取决于测量两个二元可观测量之一。研究证明，在该协议框架下可以构造出具有经典通信的密钥交换方案，从而为量子设备上反交换算子测试所需的密码学基础提供了新的理解。

DP-MacAdam: Differentially Private Mechanism with Adaptive Clipping and Adaptive Momentum

第一作者: Naima Tasnim · 方向: AI 安全

差分隐私梯度裁剪自适应裁剪动量加速DP-SGD隐藏英文摘要

Abstract:Differentially private stochastic gradient descent (DP-SGD) has become the standard framework for privacy-preserving machine learning, yet its reliance on a fixed gradient clipping threshold to limit sensitivity remains a significant practical limitation. Adaptive clipping algorithms such as AdaClip shift and scale the gradient prior to clipping and adding noise so that the clipped gradient yields a more informative descent direction. The shift and scaling parameters are selected adaptively based on the empirical mean and variance. However, in existing adaptive clipping algorithms, these empirical estimates have not been also used for momentum to accelerate training itself. On the other hand, DP-Adam is an algorithm that exploits Adam-like momentum updates based on the gradient mean and variance to accelerate training, but does not exploit these estimates for adaptive...

论文介绍 该论文针对差分隐私随机梯度下降中固定梯度裁剪阈值的局限性，提出了 DP-MacAdam 算法。它将自适应裁剪机制与 Adam 式的动量更新相结合，利用梯度的均值和方差等估计量来同时自适应地调整裁剪参数并加速训练过程。该方法旨在提升隐私保护机器学习在实践中的训练效率和模型性能。