2026-06-10

Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges

第一作者: Tiejin Chen · 方向: 隐私保护

多模态大语言模型隐私风险数据泄露安全评估模型记忆隐藏英文摘要

Abstract:Privacy risks in text-only Large Language Models (LLMs) are well studied, particularly their tendency to memorize and leak sensitive information. However, Multi-modal Large Language Models (MLLMs), which process both text and images, introduce unique privacy challenges that remain underexplored. Compared to text-only models, MLLMs can extract and expose sensitive information embedded in images, posing new privacy risks. We reveal that some MLLMs are susceptible to privacy breaches, leaking sensitive data embedded in images or stored in memory. Specifically, in this paper, we (1) introduce MM-Privacy, a comprehensive dataset designed to assess privacy risks across various multi-modal tasks and scenarios, where we define Disclosure Risks and Retention Risks. (2) systematically evaluate different MLLMs using MM-Privacy and demonstrate how models leak sensitive data across various...

论文介绍 与文本模型相比，处理图像和文本的多模态大语言模型可能暴露嵌入图像中的敏感信息，带来独特的隐私挑战。本文构建了MM-Privacy评估数据集，并系统地评估了多个MLLMs的「披露风险」与「留存风险」，实证了模型可能泄露图像中或记忆里的敏感数据，旨在推动针对多模态场景的隐私保护技术发展。

Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps

第一作者: Xiaofeng Lin · 方向: AI 安全

上下文破碎分解攻击工具使用LLM代理provenance gapAI安全越狱攻击隐藏英文摘要

Abstract:Tool-using LLM agents interact with the world through actions that persist state in artifacts (e.g., workspace files or logs). Consequently, jailbreak defenses must reason about cross-step composition rather than isolated text. Yet most existing attacks and defenses, including ``multi-turn'' jailbreaks such as Crescendo and Tree of Attacks,still assume a single contiguous conversation visible to the defender. This assumption breaks down in real agent pipelines, where enforcement is fragmented across tools, modules, and time, and where artifact provenance is often not tracked. We operationalize a deployment failure mode for tool-using LLM agents, the \emph{provenance gap}, and study reproducible triggers for it: \emph{Context-Fractured Decomposition} (CFD), a family of cross-context multi-step jailbreaks that preserve benign-looking intermediate artifacts from an early...

论文介绍 研究工具使用LLM代理中的安全漏洞，特别是跨步骤防御的弱点。提出上下文破碎分解攻击，利用provenance gap，在真实代理管道中实现越狱。该研究揭示了现有防御假设的局限性，对代理安全评估有重要意义。

Security-First Approach to API Pipeline Development with Zero-Trust Architecture

第一作者: Mahima Agarwal · 方向: 软件安全

API安全零信任架构DevSecOps安全优先框架软件安全隐藏英文摘要

Abstract:Modern enterprises face an accelerating onslaught of API-targeted threats amid a rapidly expanding attack surface. Record volumes of software vulnerabilities continue to accelerate dramatically, with 28,818 CVEs disclosed in 2023 (a 38% jump from 2022) and 40,009 CVEs in 2024 (another 38% increase), while the average time-to-exploit (TTE) of new flaws shrank to mere days (approximately 5 days in 2023, down from 32 days in 2021). At the same time, API usage dominates web traffic and has become a primary vector for breaches - 99% of organizations experienced API security incidents in the last year, with 22% suffering actual data breaches via APIs (based on industry vendor research). This paper proposes a comprehensive "security-first" framework for API pipeline development, leveraging Zero-Trust Architecture principles within DevSecOps practices to counter these trends. We...

论文介绍 面对API安全威胁加剧，提出安全优先的API管道开发框架。基于零信任架构原则，集成到DevSecOps实践中，以应对漏洞快速增长和数据泄露风险。旨在提升企业API防护能力，减少安全事件。

Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries

第一作者: Jianguo Zhu · 方向: AI 安全

RAG系统间接提示注入控制信号冒充AI安全检索增强生成隐藏英文摘要

Abstract:Retrieval-augmented generation (RAG) systems often serialize user queries, retrieved documents, metadata, system labels, and task instructions into one natural-language prompt. We study a source-authority boundary failure in this design: attacker-authored retrieved text can impersonate metadata, provenance, authority, or disclosure-policy signals that appear control-relevant to the model. We call this pattern Document-Authored Control-Signal Impersonation (DACSI). DACSI is a non-imperative, metadata-like payload subclass within indirect prompt injection. Its central lesson is simple: document-authored labels are data, not policy. Command-style injection asks the model to ignore, override, or violate policy; DACSI asks whether untrusted document text can be misattributed as an authorized control signal when RAG prompt rendering collapses trusted and untrusted text into the same...

论文介绍 针对检索增强生成系统的安全边界，研究文档作者控制信号冒充攻击。攻击者通过检索文档冒充元数据或权威信号，误导模型决策。这种低攻击成本的方法凸显了RAG系统中数据与策略区分的挑战。

Hardening Agent Benchmarks with Adversarial Hacker-Fixer Loops

第一作者: Ziqian Zhong · 方向: 软件安全

代理基准奖励黑客攻击黑客-修复循环LLM代理安全评估隐藏英文摘要

Abstract:Agent benchmarks score submissions with outcome verifiers that are typically hand-written and brittle, leaving them open to reward hacking. We audit 1,968 tasks across five terminal-agent benchmarks and find 323 (16%) hackable by frontier models given only the task description. This corrupts both leaderboard rankings and RL training signal, yet the standard response is manual and reactive. We introduce the hacker-fixer loop, a method for building exploit-resistant verifiers without per-task manual patching. The loop alternates three LLM agents: a hacker tries to pass the verifier without solving the task, a fixer patches the verifier to reject each discovered exploit, and a solver confirms the patched verifier still admits legitimate solutions. The loop iterates: each patch reshapes what the verifier rewards, surfacing the next exploit. We further add verifier access, and let...

论文介绍 代理基准的验证器易受奖励黑客攻击影响，导致排名和训练信号失真。提出黑客-修复循环方法，通过LLM代理交替黑客攻击、修复和验证，自动加固验证器，提高基准的抗攻击性。

Block-A-Mole: The Sustainability Frontier of Moving-Target Censorship Resistance

第一作者: Anindya Maiti · 方向: 系统安全

互联网审查移动目标抵抗可持续性前沿网络自由安全协议隐藏英文摘要

Abstract:Internet censorship affects over four billion people, and deployed circumvention systems share a common weakness: their endpoints are fixed and discoverable, so a patient censor can enumerate and block them. Moving-target circumvention systems instead rotate endpoints across commercial cloud address space faster than censors can react, but the field lacks a theory of when rotation works, leaving rotation intervals and pool sizes to intuition. We give the first formal account of moving-target censorship resistance by modeling the censor-defender interaction as a continuous-time timing game over a combinatorial address-domain space, generalizing FlipIt to a collateral-bounded adversary. We prove a sustainability frontier separating configurations a censor can defeat from those it cannot, and show that under the Great Firewall's 2024 shift to blocking QUIC and TLS by domain, raw...

论文介绍 移动目标审查抵抗系统通过快速轮换端点规避封锁，但缺乏理论指导。将审查者-防御者交互建模为连续时间博弈，证明可持续性前沿，为系统配置提供理论依据，应对如Great Firewall的封锁策略。

Evaluating Multimodal Steganalysis for Split-Payload Audiovisual Steganography

第一作者: Prateek Paudel · 方向: 安全研究

隐写术隐写分析音视频分割有效载荷安全通信隐藏英文摘要

Abstract:The aim of steganography is to hide secret information inside ordinary media so that the existence of communication is hidden rather than encrypted. In audiovisual context, the availability of audio and video streams creates an opportunity to split a payload across these two modes thus, reducing the embedding burden on any single carrier. This paper evaluates whether such split-payload audiovisual steganography can help evade unimodal and multimodal steganalysis under synchronized and asynchronous embedding settings. We create audiovisual samples where the hidden message is divided between the audio and video tracks, and then test how well different detectors can identify them. The single mode detectors performs close to random guessing, thus showing the benefit of this hiding mechanism, while the multimodal model initially appears more effective. However, further checks show...

论文介绍 评估分割有效载荷的音视频隐写术对隐写分析的效果。通过将秘密信息分割到音频和视频轨道，测试检测器性能。发现单模态检测器效果差，多模态模型初始有效但需进一步验证其鲁棒性。

AutoSUT: The Environment Semantics Gap in Structured CTI for Adversary Emulation

第一作者: Sidnei Barbieri · 方向: 软件安全

网络威胁情报对手仿真环境语义差距MITRE ATT&CK安全测试隐藏英文摘要

Abstract:Structured Cyber Threat Intelligence (CTI) is increasingly used for adversary emulation, detection evaluation, and cyber range design. However, these workflows still require a target System Under Test (SUT) whose environment is not fully described by public CTI. We measure how much of that environment can be derived from MITRE ATT&CK Structured Threat Information Expression (STIX) bundles. Using the ATT&CK Enterprise, Mobile, and Industrial Control Systems datasets, with CAPEC and FiGHT as comparison datasets, we evaluate platform coverage, software specificity, vulnerability evidence, and deployment compatibility. Platform annotations are common, but software references rarely include versions or Common Platform Enumeration (CPE) identifiers. In Enterprise, 97.6% of software objects lack both, and campaign-level Common Vulnerabilities and Exposures (CVEs) remain sparse. Our...

论文介绍 结构化网络威胁情报用于对手仿真时，环境描述存在语义差距。通过分析MITRE ATT&CK数据集，发现平台覆盖和软件特异性不足，影响仿真实施的准确性，提出改进方向。

Asymptotic Optimality of the High-Dimensional Gaussian Mechanism and Improved Low-Dimensional Mechanisms for Differential Privacy

第一作者: Yu Wei · 方向: 隐私保护

差分隐私高斯机制隐私保护数据安全统计机制隐藏英文摘要

Abstract:The additive noise mechanism is a foundational tool for differential privacy (DP) of $T$-dimensional real-valued vector queries. The Gaussian mechanism, utilizing Gaussian noise, is the mostly widely used such mechanism, due to its simplicity and strong privacy guarantees. In this work, we provide justification for this choice, showing that as the dimension $T\to\infty$, no additive-noise mechanism can asymptotically improve on the Gaussian mechanism's privacy--utility tradeoff for the strong privacy settings typically this http URL also develop a new family of \emph{Spherical Generalized Gamma} DP mechanisms, which contains both the Gaussian mechanism and the recently studied $\ell_2$ mechanism (Joseph \emph{et al.}, ICML 2025). We identify members of this family that outperform both the Gaussian and $\ell_2$ mechanisms in certain low-dimensional settings, and show tight...

论文介绍 研究差分隐私中噪声机制的隐私-效用权衡。证明高维下高斯机制渐近最优，并提出球形广义伽马机制家族，在低维设置下改进性能，为隐私保护提供理论支持。

X-rated Compliance Theater: An Empirical Evaluation of European Age Verification Systems in Adult Websites

第一作者: Simone Lavermicocca · 方向: 隐私保护

隐私保护年龄验证安全评估欧洲法规成人网站隐藏英文摘要

Abstract:Age verification is rapidly emerging as a central regulatory instrument for protecting minors online, with several jurisdictions mandating its deployment for access to adult and pornographic content. This regulatory direction raises significant privacy concerns, as it risks binding sensitive content access to identity-related attributes. It also introduces security risks, since age-verification mechanisms are often outsourced to third-party providers with limited transparency into the robustness of their verification processes. In this work, we conduct, to the best of our knowledge, the first exploratory security assessment of regulation-mandated age-verification mechanisms deployed by adult websites. Rather than treating age verification as a purely regulatory question, we empirically examine whether current deployments provide security guarantees commensurate with the...

论文介绍 本文实证评估欧洲成人网站上法规强制实施的年龄验证系统，探讨其隐私和安全问题。研究聚焦于当前部署是否提供与监管目标相称的安全保证，发现存在敏感内容访问与身份属性绑定风险，以及第三方验证过程不透明带来的安全隐患。结果可能为设计更安全的年龄验证方案提供指导。

Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems

第一作者: Kuncan Wang · 方向: AI 安全

AI安全数据代理LLM漏洞分析攻击分类隐藏英文摘要

Abstract:Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution, and agent reasoning, recombining concerns from database security and general-purpose LLM-agent security into failure modes that neither line of work captures on its own. To address this gap, we present a systematic security study of data agents. Our contributions are threefold. First, we develop a layered vulnerability framework that identifies eight data agent-specific risks across interpretation, execution, and policy layers. Second, we introduce an attack taxonomy organized by adversary goal, tactic, and technique, covering three goals, seven tactics, and fourteen techniques, and...

论文介绍 研究针对LLM驱动的数据分析代理的安全漏洞，这些代理集成推理、数据访问和工具执行。文章提出分层漏洞框架，识别解释、执行和政策层的八种风险，并引入按目标、战术和技术组织的攻击分类，涵盖十四种技术。意义在于系统揭示数据代理的特定安全威胁，弥补现有数据库安全和LLM安全研究的不足。

Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning

第一作者: Bernhard Kneip · 方向: AI 安全

Web安全日志分析LLM可解释AI少样本学习隐藏英文摘要

Abstract:Forensic analysis of web server logs demands both accurate detection and human-readable explanations that can satisfy legal requirements. We present CEF-Log, a context-enhanced few-shot chain-of-thought prompting strategy for Large Language Models that addresses this dual requirement. CEF-Log embeds expert investigative methodology through a structured five-step reasoning template, enabling the model to learn \textit{how} to analyze logs rather than \textit{what} patterns to memorize. Experimental evaluation demonstrates that CEF-Log achieves an F1-score of 0.99 on the CSIC 2010 dataset using only four examples while providing a $10\times$ improvement in sample efficiency compared to other prompting-based methods. We also introduce ForenWebLog, a new dataset that incorporates real-world attacks and multi-step attack sequences for comprehensive evaluation. Qualitative analysis...

论文介绍 提出CEF-Log策略，利用大语言模型通过上下文增强的少样本链式思考提示检测恶意Web服务器日志。方法嵌入专家调查模板，实现高F1分数和样本效率提升，并提供可解释推理以满足取证需求。同时引入新数据集ForenWebLog用于综合评估，适用于安全监控和数字取证场景。

Exploring CKKS Parameter Trade-offs for Privacy-Preserving Personalized Federated Learning

第一作者: Kamolchanok Saengtong · 方向: 密码学协议

隐私保护联邦学习同态加密CKKS参数优化隐藏英文摘要

Abstract:Privacy-preserving Personalized Federated Learning (PFL) enables clients to collaboratively train personalized models without exposing raw data, but exchanged model updates remain vulnerable to inference attacks from honest-but-curious servers. Homomorphic Encryption (HE) addresses this by allowing server-side aggregation directly on encrypted updates, with the CKKS scheme being particularly suitable due to its native support for approximate floating-point arithmetic. However, no prior work has examined how to configure CKKS for PFL deployments, leaving practitioners without principled guidance on parameter selection that directly affects privacy, precision, and computational cost. This paper presents pFedCKKS, a generic framework integrating CKKS into PFL, and provides the first systematic parameter selection guide for practitioners. We derive the full CKKS parameter...

论文介绍 探索CKKS同态加密在隐私保护个性化联邦学习中的应用，提出pFedCKKS通用框架。文章首次提供系统性参数选择指南，分析CKKS参数对隐私、精度和计算成本的影响权衡，帮助实践者优化部署。意义在于为个性化联邦学习中安全聚合提供实操指导，提升数据隐私保护水平。

Digital White Spaces: A Cyberpsychology-Informed Framework to Mobile Phone Addiction

第一作者: Leandros Maglaras · 方向: 网络安全

网络心理学手机成瘾干预框架AI检测数字健康隐藏英文摘要

Abstract:Mobile phone overuse and attention fragmentation have become pressing societal and public health concerns. Cyberpsychology research highlights addictive engagement loops driven by intermittent rewards, persuasive design, and habit formation. In this article, we use current evidence on mobile-phone addiction and propose "Digital White Spaces" (DWS), a socio-technical framework that combines privacy-preserving monitoring, AI-driven detection of addictive loops, device-mode interventions, and physical signal-limited zones to minimize digital stimulation and internet addiction.

论文介绍 基于网络心理学证据，提出「数字白空间」框架应对手机过度使用和注意力碎片化问题。框架整合隐私保护监控、AI驱动成瘾循环检测、设备模式干预和物理信号限制区，以减少数字刺激。可能应用于公共健康领域，促进数字福祉和减轻网络成瘾的社会影响。

AI Code Sandboxes: A Comparative Security Study. Part 1 of 2 -- Engine-Level Properties (Attack Surface, Leakage, Stackability, CVE History, Patch Cadence, Fuzzing)

第一作者: George Andronchik · 方向: 软件安全

软件安全沙箱隔离技术安全评估漏洞管理隐藏英文摘要

Abstract:This paper reads six engine-level measurements together -- 1.1 host attack surface, 1.2 information leakage, 1.3 defense-in-depth stackability, 1.4 public CVE history, 1.5 patch cadence, and 1.6 upstream fuzzing posture -- to describe how five AI-sandbox products isolate guest code from the host kernel. No single axis is a sufficient basis for a comparative judgement; the cross-axis reading is the load-bearing analysis. Three high-level findings: (1) engine classes (microVM, userspace kernel, OCI container) separate cleanly on every architectural axis, but products within a class do not; (2) product pin policy is the dominant operator-facing variable -- engine-side patch latency aggregates to ~0 days for coordinated disclosures, while downstream lag spans 0 days to 471+ days to "opaque" to infinity; (3) fuzzing investment splits into three tiers, and the strongest combination...

论文介绍 对五款AI代码沙箱产品进行安全比较研究，分析攻击面、信息泄露、深度防御堆叠性、CVE历史、补丁周期和模糊测试等引擎级属性。发现引擎类别在架构轴上清晰分离，但产品内差异小；补丁策略是关键操作变量，模糊测试投入分三层。结果为选择安全沙箱提供跨轴评估依据。

Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection

第一作者: Mudit Sinha · 方向: AI 安全

AI安全提示注入隐写术LLM漏洞防御绕过隐藏英文摘要

Abstract:Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views. We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks: a payload caught in plain English slips past the same detector when it is transported as structured float parameters and reconstructed only as fragmented telemetry. Across 14,400 attacked real-model trials on three commercial LLM APIs from different providers, the IFS-derived float-array carrier preserves 94.3% leakage ASR under the strongest dual-layer text-classifier defense evaluated in the main matrix: a Prompt Guard 2 + TF-IDF ensemble; the same carrier-level pattern also replicates with a fine-tuned roberta-base detector. We emphasize leakage ASR because downstream systems may act on quoted or reproduced markers even when the model refuses...

论文介绍 研究通过浮点参数进行隐写术运输的间接提示和内容注入攻击，绕过文本分类器防御。实验在商业LLM API上测试，显示载波在强防御下仍保持高泄漏成功率。揭示当前文本中心防御的局限性，强调需要新方法检测结构化数据中的恶意信号，对LLM安全防护具有启示意义。

SoK: Reconstruction Attacks on Synthetic Tabular Data (Insights from Winning the NIST CRC)

第一作者: Steven Golob · 方向: AI 安全

隐私保护合成数据重建攻击表格数据安全评估隐藏英文摘要

Abstract:Synthetic data is increasingly promoted as a privacy-preserving substitute for releasing sensitive tabular records, yet its central adversarial threat ("reconstruction", the recovery of an individual's hidden attribute values from a synthetic release and a handful of known quasi-identifiers) has been studied only in scattered, hard-to-compare settings. We present the first systematization of reconstruction (equivalently, attribute inference) attacks on de-identified and synthetic tabular data. We contribute a taxonomy that organizes attacks by the structure they exploit; the most systematic empirical evaluation to date, pitting fourteen attacks against nine synthetic data generation (SDG) methods across five benchmark datasets; and a set of new attacks that fill gaps in the taxonomy, one of which (CoBP-RA) is the strongest attack we measure. Crucially, we introduce a...

论文介绍 系统化研究合成表格数据的重建攻击，即从合成发布和已知准标识符恢复个体属性。文章贡献攻击分类法、迄今最全面的实证评估（涉及十四种攻击和九种生成方法），并提出新攻击方法填补空白，其中CoBP-RA最强。基于NIST竞赛获胜经验，为合成数据隐私风险提供系统分析框架。

An AI Security Agent for University ACMIS: Multi-Vector Threat Detection and Automated Response

第一作者: Joseph Walusimbi · 方向: 系统安全

AI安全代理多向量威胁检测自动化响应学术管理系统异常检测隐藏英文摘要

Abstract:University Academic Management Information Systems (ACMIS) are high-value targets for a wide spectrum of security threats including brute-force login attacks, payment fraud, privilege escalation, insider data theft, and academic integrity violations. Traditional rule-based intrusion detection systems are inadequate because many malicious activities are structurally indistinguishable from normal operations. This paper presents an AI-based security agent for ACMIS that combines supervised anomaly detection, behavioural analytics, and a natural language processing chatbot for secure password recovery. The agent monitors five operational layers: authentication, authorisation, financial transactions, user behaviour, and system health, and responds through a four-tier risk escalation framework. A modular architecture allows the core engine to be extended to other institutional...

论文介绍 本文针对大学学术管理信息系统面临的多维度安全威胁，提出一种AI驱动的安全代理方案。该系统结合了监督式异常检测、行为分析和自然语言处理聊天机器人，能够监控认证、授权、财务交易等五个层面。通过模块化架构和四级风险响应框架，该代理旨在解决传统规则系统难以区分正常与恶意活动的问题，以增强系统的整体安全韧性。

Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning

第一作者: Sheng Wan · 方向: 隐私保护

联邦学习隐私风险logit模型窃取攻击AdaMSA隐藏英文摘要

Abstract:Federated learning aims to protect data privacy by collaboratively learning a model without sharing private data among clients. Unlike traditional parameter-based FL methods that exchange model weights or gradients during training, emerging logit-based FL approaches share model outputs (logits) on public data. This strategy promotes model heterogeneity, reduces communication overhead, and enhances clients' privacy. However, the potential privacy risks associated with these logit-based methods have been largely overlooked. This research presents the first theoretical and empirical analysis of a hidden privacy risk in logit-based FL methods - the risk that a semi-honest server (adversary) may learn clients' private models from logits. To quantify and address this threat, we develop the Adaptive Model Stealing Attack (AdaMSA) by leveraging historical logits during training...

论文介绍 联邦学习中，基于logit（模型输出）的共享方式被提出以降低通信开销并提升隐私性。然而，本文首次从理论和实验上揭示了其潜在隐私风险：半诚实服务器可能通过分析公开数据的logit来窃取客户端的私有模型。为量化并应对此威胁，研究者提出了自适应模型窃取攻击（AdaMSA），并设计了相应的防御策略，增强了logit-based联邦学习的安全性。

LPOR: A Layered Proof of Reserves Framework for Usable and Publicly Auditable Solvency Verification

第一作者: Donggoo Kim · 方向: 密码学协议

06/06 22:56

储备证明公开审计透明度零知识证明密码学协议隐藏英文摘要

Proof of Reserves (PoR) enables centralized crypto exchanges to demonstrate that on-chain reserves are sufficient to cover customer liabilities. However, existing approaches, including Merkle-tree-based proofs and zero-knowledge PoR systems, remain difficult for everyday users to verify in practice, resulting in limited participation and weakened transparency. We introduce LPOR, a layered, usability-focused PoR framework that separates lightweight user-side checks from auditor-level cryptographic verification, enabling non-technical users to verify inclusion and publicly recompute total liabilities with minimal friction. By lowering verification barriers, LPOR increases user participation and substantially improves the probability of detecting omitted liabilities. We evaluate its scalability and omission detectability at a multi-million-user scale.

论文介绍 为提升加密货币交易所储备证明的透明度和用户参与度，本文提出了一个分层、注重可用性的LPOR框架。该框架将轻量级的用户侧检查与审计级的密码学验证分离，使得非技术用户也能以较低门槛验证其账户是否被正确包含在负债中。这种设计旨在降低验证壁垒，提高用户参与度，并显著增强检测遗漏负债的能力。

AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation

第一作者: Bilal Hussain · 方向: 网络安全

6G网络物理系统AI原生安全闭环架构边缘计算隐藏英文摘要

Abstract:In sixth-generation (6G) networks, billions of cyber-physical systems (CPSs) - autonomous vehicles, smart grids, industrial robots, and remote-surgical equipment - will run over ultra-reliable low-latency slices, collapsing the gap between a remote breach and physical harm to milliseconds, a budget perimeter firewalls and centralised security operations centres cannot meet. This survey reframes 6G CPS security as a closed-loop, AI-native pipeline that senses at the multi-access edge computing (MEC) tier, using minute-scale call-detail records (CDRs) for baseline learning and sub-millisecond RAN/Open-RAN (O-RAN) telemetry for the latency-critical path. It decides locally with compressed deep models, mitigates network-wide via SDN, NFV, and O-RAN controllers, and retrains through federated learning (FL) and digital-twin (DT) replay. We formalise a per-slice, tail-bounded latency...

论文介绍 本文是一篇关于6G网络中网络物理系统安全的综述。文章将6G CPS安全重新定义为一个AI原生的闭环管道，该管道在多接入边缘计算层感知威胁，利用深度模型进行本地决策，并通过SDN/NFV控制器进行全网缓解。它还结合了联邦学习和数字孪生进行模型重训练，旨在应对6G超低延迟场景下从网络攻击到物理伤害仅毫秒级间隔的挑战。

Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR

第一作者: Kerri Prinos · 方向: AI 安全

评估框架自主防御端点检测与响应仿真-真实差距AI安全隐藏英文摘要

Abstract:Leading commercial endpoint detection and response (EDR) products have shifted from operator-configured rule sets to multi-component systems where autonomous AI components operate alongside, and increasingly in place of, operator-deployed policies. Autonomous defense agents using commercial EDR as their hardening tool are no longer tuning a passive tool, but a black-box autonomous system capable of making vendor-specific decisions. We present the first evaluation framework for autonomous defense agents hardening commercial EDR. We instantiate it in a Game of Active Directory (GOAD) lab with this http URL's NodeZero as the autonomous pentester and Microsoft Defender XDR as the EDR. We run a sample benchmark of defense agents with two large language model (LLM) backbones (Claude Sonnet 4.6 and Cisco Foundation-Sec-8B). We report three lessons learned that neither simulation nor...

论文介绍 商业端点检测与响应产品正变得自主化，但评估强化此类产品的自主防御代理却很困难。本文提出了首个针对商业EDR的自主防御代理评估框架。该框架在一个模拟活动目录的实验室环境中，使用自主渗透测试工具和EDR产品进行实例化，并测试了两种不同大语言模型作为后端的防御代理，旨在弥合仿真环境与真实世界评估之间的差距。

Policy Description Language for Authorization using Logic-Based Programming

第一作者: Masaki Hashimoto · 方向: 安全研究

策略描述语言细粒度授权Datalog多层防御访问控制隐藏英文摘要

Abstract:Recently, with the impossibility of eradicating the vulnerabilities of information systems, we must prepare for the occurrence of the security incident by the multi-layer defense called the Defense-in-Depth strategy. In the multi-layer defense, it is important to authorize accesses in fine-grained granularity to compose each layer effectively, and many access control models are proposed to follow them. However, policy description languages proposed so far cannot express the models appropriately in proper granularity. In this paper, we propose a policy description language which can designate many kinds of conditions for access control, such as the dynamic status of an application process, as an element of decision data, and implement it in Datalog. Using the proposed language, we compose the policy of SELinux, which is a major implementation achieving the multi-layer defense...

论文介绍 为了在深度防御策略中实现更精细的授权控制，本文提出了一种新的策略描述语言。该语言能够以适当的粒度表达多种访问控制条件，例如应用程序进程的动态状态，并基于Datalog进行了实现。与以往语言相比，它旨在更恰当地描述复杂的访问控制模型，并通过构成SELinux的策略来展示其能力，以支持有效组合多层防御。

The Dodona Protocol: A Living Design Science Experiment in Oracle Design

第一作者: Giulio Caldarelli · 方向: 密码学协议

预言机协议设计科学区块链链无关Dodona隐藏英文摘要

Abstract:The oracle problem, broadly understood as the difficulty of reliably incorporating external information into blockchain-based systems, has been widely examined by scholars and practitioners. Recent comparative research has shown that several challenges of modern blockchain oracles, including attributability, accountability, integrity, and query design, mirror procedural and epistemic constraints already present in ancient oracular institutions such as the Delphic Oracle. Yet the translation of these insights into applied oracle design remains largely unexplored. This paper introduces the Dodona Protocol, a modular, chain-agnostic oracle service inspired by procedural patterns identified in ancient and modern oracle systems. Named after the Oracle of Zeus at Dodona, one of the oldest oracular sanctuaries in ancient Greece, the protocol operationalizes principles such as...

论文介绍 本文介绍了Dodona协议，这是一个受古代与现代预言机系统程序模式启发的、模块化且链无关的预言机服务。该研究将设计科学实验应用于预言机设计，旨在将关于归因、问责、完整性等挑战的学术洞察转化为实际方案。协议以古希腊的多多纳神谕命名，尝试将历史智慧中的程序性原则应用于区块链外部数据集成问题。

RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

第一作者: Abid Aziz · 方向: 安全研究

运行时监控推理攻击大语言模型拒绝服务令牌消耗隐藏英文摘要

Abstract:Reasoning-capable large language models can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety classifiers often miss these attacks because the injected prompts can appear syntactically benign. We build RecurGuard, a runtime monitor for detecting reasoning-chain consumption attacks when reasoning traces are exposed by the model. RecurGuard analyzes reasoning traces as they are generated and tracks three signals: recurrence rate, volume growth, and progress toward the user's query. If all three signals remain anomalous over three consecutive chunks, RecurGuard terminates generation early. We evaluate RecurGuard against OverThink and ExtendAttack across open-weight reasoning models and...

论文介绍 本文研究针对具备推理能力的大语言模型的“推理令牌消耗攻击”，即攻击者注入诱饵任务，诱导模型耗尽生成预算而无法回答用户问题，造成服务拒绝或经济损失。为此，研究者构建了RecurGuard，一个在推理链暴露时进行检测的运行时监控器。它通过分析推理链的递归率、体积增长等信号来识别攻击，并在信号持续异常时提前终止生成。

Demand-Driven Vulnerability Detection for Cloud Security Posture Management: Removing Human Rule Authoring from the Disclosure-to-Protection Critical Path

第一作者: Prashant Kumar Pathak · 方向: 软件安全

云安全态势管理漏洞检测需求驱动规则自动化网络安全隐藏英文摘要

Abstract:Cloud Security Posture Management (CSPM) systems detect known vulnerabilities by maintaining a rule set, distributing it to customers, and evaluating it against periodically-collected asset inventories. To our knowledge, in publicly documented architectures the rule set is environment-agnostic and curated centrally by the vendor; updates are batched into release cycles and shipped on a cadence ranging from hours to days depending on detection severity. The disclosure-to-protection window -- from a CVE being published to the customer's system being capable of detecting affected assets -- is therefore bounded by the vendor's release cadence for version-match detections, and by additional human authoring time for richer detections incorporating configuration predicates beyond the affected-software string. We propose an architecture in which the rule set is not vendor-distributed...

论文介绍 研究云安全态势管理（CSPM）系统中漏洞检测的延迟问题。现有系统依赖厂商集中更新规则，导致从漏洞披露到保护存在窗口期。本文提出需求驱动架构，通过自动化规则生成移除人工编写，实现按需检测。该方法能缩短响应时间，提升云环境安全性。

POISE: Position-Aware Undetectable Skill Injection on LLM Agents

第一作者: Haochang Hao · 方向: AI 安全

06/06 10:10

LLM代理技能注入攻击位置感知隐蔽攻击AI安全隐藏英文摘要

Agent skills provide a lightweight mechanism for extending general-purpose agents, but their open format exposes them to skill-poisoning attacks. A practically dangerous injection must stay invisible: if executing the payload derails the user's legitimate task, the resulting failure signal invites inspection of the skill. We therefore evaluate attacks by Attack Success Rate, which requires the injected payload to execute and the user's task to still pass its verifier in the same trial. Prior skill-poisoning attacks face a reliability-stealth trade-off under this lens: YAML-header injections are reliably loaded but easily inspected, whereas stealthier body injections that place explicit malicious commands in the skill prose are less reliable because out-of-context commands invite the agent's own suspicion. We introduce POISE, a position-aware attack that compresses the trigger into a...

论文介绍 针对大型语言模型（LLM）代理的技能注入攻击，攻击者可注入恶意代码影响代理行为。现有攻击方法在隐蔽性与可靠性之间存在权衡。本文提出POISE，一种位置感知攻击，通过压缩触发词提高隐蔽性，同时保持攻击成功率。该工作有助于测试和增强LLM代理的安全机制。

Collective Hallucination in Multi-Agent LLMs:Modeling and Defense

第一作者: Saeid Jamshidi · 方向: AI 安全

多代理LLM集体幻觉错误传播防御方法系统建模隐藏英文摘要

Abstract:Hallucinations in large language models (LLMs) create heightened risks in multi-agent settings, where recursive agent interactions can propagate, reinforce, and amplify unsupported claims. This paper models hallucination as a system-level, time-evolving process across a network of interacting LLM agents, where nodes represent agents and edges encode information exchange. The proposed formulation captures how hallucinated claims diffuse through communication topologies, intensify under adversarial perturbations, and affect collective reliability across reasoning rounds. To suppress error propagation, we introduce an interaction-aware control method that combines confidence-weighted aggregation, adaptive impact regulation, external claim verification, and selective isolation of unreliable agents. Experiments on TruthfulQA and TriviaQA show that the proposed method reduces...

论文介绍 在多代理LLM系统中，幻觉错误可能通过代理间交互传播和放大。本文将幻觉建模为时变网络过程，分析其扩散机制。为抑制错误传播，提出交互感知控制方法，结合置信度加权、影响调节等策略。实验显示该方法能有效降低集体幻觉，提高系统可靠性。

SGTO-MAS: Secure Gorilla Troops Optimization for Multi-Agent LLM Systems

第一作者: Saeid Jamshidi · 方向: AI 安全

多代理LLM优化协调安全感知群体智能资源管理隐藏英文摘要

Abstract:Multi-agent large language model (LLM) systems offer strong capabilities for complex reasoning and decision-making, yet coordination across agents introduces error propagation, security risks, and inefficient use of resources. Existing methods often rely on heuristic, static strategies and lack a principled mechanism for balancing performance, security, and computational cost. This paper formulates multi-agent LLM coordination as a constrained optimization problem and proposes a security-aware method for adaptive agent selection. The method integrates trust modeling, risk-aware evaluation, and collective intelligence within a unified optimization objective. To solve the problem efficiently, we use a swarm-intelligence strategy inspired by Gorilla Troops Optimization (GTO), enabling adaptive coordination under varying threat conditions. Controlled experiments across 500...

论文介绍 多代理LLM系统在协调中面临安全风险和效率挑战。现有方法缺乏原则性优化机制。本文将协调问题形式化为约束优化，提出SGTO-MAS方法，基于群体智能进行自适应代理选择，平衡性能、安全与计算成本。该方法通过信任建模和风险评估提升系统鲁棒性。

Hallucination Cascade: Analyzing Error Propagation in Multi-Agent LLM Systems

第一作者: Saeid Jamshidi · 方向: AI 安全

多代理LLM幻觉级联错误传播级联深度动态分析隐藏英文摘要

Abstract:Large Language Models (LLMs) generate fluent text but remain vulnerable to hallucinations, producing unsupported, inconsistent, and factually incorrect claims. Most prior work treats hallucination as a static property of isolated outputs. In multi-agent LLM systems, however, responses are exchanged across agents, revised through sequential stages, and reused as context for later reasoning. Hallucination, therefore, becomes a dynamic process shaped by interaction history, cascade depth, and model heterogeneity. This paper analyzes hallucination dynamics in multi-agent LLM cascades by tracking claim-level factual inconsistencies across sequential agent interactions. We conduct 500 cascade experiments across 10 knowledge domains using GPT-5.3, DeepSeek-V3, and LLaMA-3-70B-Instruct, yielding 1,250 evaluated responses. Results show that deeper cascades reduce the normalized...

论文介绍 多代理LLM系统中的幻觉具有动态级联特性，现有研究多关注静态属性。本文通过级联实验跟踪声称级事实不一致，分析幻觉如何随交互深度和模型异质性传播。结果表明更深层的级联可能减少幻觉强度，但传播模式复杂。该工作为理解错误传播提供新视角。

DP4SQL: Differentially Private SQL with Flexible Privacy Policies

第一作者: Andrew Cascio · 方向: 隐私保护

06/06 06:35

差分隐私SQL隐私策略关系数据库数据保护隐藏英文摘要

The plausible deniability model of differential privacy for single-table datasets is well-understood. However, applying differential privacy to relational databases is much trickier: each application needs flexibility in specifying the pieces of information about an entity, spread across multiple relations, that require plausible deniability guarantees. Existing differentially private SQL systems only support rigid privacy policies. Even seemingly small changes, such as specifying that some tables need to protect the existence of records while others only need to protect the record contents, require significant manual effort in updating their privacy accountants and proving their correctness. One example of a challenge is the presence of partially public data. Public columns in a table (e.g., faculty names in a university dataset and partial course enrollment information) can cause...

论文介绍 将差分隐私应用于关系数据库时，现有SQL系统支持隐私策略僵化，难以灵活调整。本文提出DP4SQL，支持灵活隐私策略，如区分记录存在性与内容保护。该系统能处理部分公开数据等挑战，通过动态隐私会计简化配置，增强数据库查询的隐私保护。

Model Multiplicity for Adversarial Detection in Small Language Model Training on Edge Devices

第一作者: Stefan Behfar · 方向: AI 安全

边缘设备语言模型训练对抗性检测模型多样性分布式安全隐藏英文摘要

Abstract:The rise of edge-based machine learning has enabled distributed adaptation of language models across mobile and IoT devices, offering privacy preservation and real-time responsiveness. However, distributed fine-tuning of language models on untrusted or heterogeneous edge nodes introduces new vulnerabilities. Compromised or unreliable devices can inject poisoned updates, leading to stealthy model manipulation or convergence degradation. Classical defenses such as robust aggregation or temporal anomaly detection operate on a single global model and are therefore limited in detecting coordinated or persistent poisoning. This work proposes a new system-level defense based on model multiplicity. Instead of maintaining one global model, the system rotates or concurrently trains multiple small language models (e.g., DistilGPT-2), each updated by independently sampled subsets of edge...

论文介绍 在边缘设备上分布式训练语言模型时，不可靠节点可能注入中毒更新。传统防御基于单一全局模型，检测能力有限。本文提出基于模型多样性的防御，同时训练多个小语言模型，通过独立采样子集更新，增强对抗性检测。该方法利用模型旋转或并行训练提升安全性。

Beyond Pass/Fail: Using Process Mining to Understand How LLMs Resist (and Fail) Red Team Attacks

第一作者: Zvi Topol · 方向: 软件安全

过程挖掘红队攻击LLM安全防御分析状态转换隐藏英文摘要

Abstract:Standard AI red teaming evaluations reduce adversarial campaigns to a single binary outcome, attack success rate (ASR), not taking into account the sequential structure of how models resist or yield to attacks. We propose applying process mining, a discipline for discovering and analyzing process models from event logs, to red teaming traces. We conduct a controlled experiment pitting 60 HarmBench prompts against two LLMs, GPT-OSS 120B and Llama 3.3 70B, using 10 prompt mutation strategies over up to 110 attempts per prompt. From the resulting 8,575 scored events we extract Directly-Follows Graphs (DFGs) and state transition matrices that reveal structurally distinct defense profiles invisible to ASR alone: GPT-OSS exhibits a near-absorbing refusal state, while Llama presents multiple porous escape routes from refusal to getting successfully jailbroken. We further show that...

论文介绍 标准AI红队评估仅以攻击成功率（ASR）为指标，忽略攻击序列结构。本文应用过程挖掘分析LLM对抗轨迹，提取直接跟随图和状态转换矩阵，揭示不同模型的防御模式。实验显示GPT-OSS具有吸收性拒绝状态，而Llama存在多孔逃逸路径，为深入评估提供工具。

Ternary public-key cryptosystem

第一作者: Steven Duplij · 方向: 密码学协议

三元公钥密码系统ElGamal协议三元代数结构密码学协议隐藏英文摘要

Abstract:Public-key cryptosystems eliminate the requirement for pre-shared secret keys by enabling encryption with a publicly disclosed key and decryption with a corresponding private key. In this article we generalize the public-key cryptosystems to ternary algebraic structures, with particular attention to ElGamal as a representative family. We introduce the necessary algebraic background for nonderived ternary structures, including special elements, ternary group rings, and a matrix ternarization procedure that maps binary rings and group rings to antidiagonal symbolic matrices closed under ternary multiplication. Building on these foundations, we formulate a ternary analogue of the ElGamal three-step protocol (key generation, ephemeral encryption, and decryption via querelements) and derive explicit ternary power and querelement formulas that enable correct decryption. Concrete...

论文介绍 本文将公钥密码系统推广到三元代数结构，特别关注ElGamal家族。研究问题在于扩展经典密码系统至三元框架，核心方法是引入非导出三元结构、特殊元素和矩阵三元化过程，并提出三元ElGamal协议及其解密公式。可能应用于新型加密方案设计。

Quantum-Inspired Reinforcement Learning for Low-Latency Intrusion Detection in V2X and Internet-of-Vehicles Networks

第一作者: Sajid Anwer · 方向: AI 安全

量子启发强化学习入侵检测车联网V2X隐藏英文摘要

Abstract:Smart cities increasingly depend on dense edge, IoT, and vehicular networks to deliver critical urban services, including traffic control, connected mobility, infrastructure monitoring, and energy management. In this ecosystem, the Internet of Vehicles (IoV) is central to intelligent transportation, enabling continuous communication among vehicles, roadside infrastructure, and cloud-edge platforms. This connectivity, however, also enlarges the attack surface and exposes smart city and vehicular systems to evolving cyber threats that can compromise safety, privacy, data integrity, and service continuity. Conventional static defenses are often inadequate because they cannot autonomously adapt to changing attack behaviors or multi-stage intrusion patterns. This paper proposes QIRL, a Quantum-Inspired Reinforcement Learning framework built on a lightweight Deep Q-Network...

论文介绍 本文解决车联网（IoV）中低延迟入侵检测的挑战，提出QIRL框架。该框架使用量子启发强化学习和轻量级深度Q网络，以自主适应动态攻击模式。意义在于提升智能城市交通系统的安全性和实时性。

Belief-Space Quantum-Inspired Reinforcement Learning for Partially Observable Autonomous Cyber Defense in the Internet of Vehicles

第一作者: Anwar Shah · 方向: AI 安全

信念空间量子启发强化学习车联网安全部分可观察隐藏英文摘要

Abstract:The Internet of Vehicles (IoV) faces a dynamic, adversarial security environment where attackers adapt to defenses. Existing intrusion detection systems rely on static classifiers that fail to capture sequential decision-making, attacker adaptation, and uncertainty. We formulate IoV security as a sequential attacker-defender interaction and model defense as a reinforcement learning problem under partial observability. We propose Quantum Belief-Integrated Reinforcement Defense (Q-BIRD), using quantum-inspired belief representation to encode defender uncertainty about hidden attacker intent via amplitude-based states, enabling non-Bayesian belief evolution. Integrated into a Proximal Policy Optimization (PPO) defender, Q-BIRD selects cost-aware mitigation actions. In simulated environments with adaptive, probing attackers, Q-BIRD reduced cumulative mean damage, damage variance...

论文介绍 本文将车联网安全建模为部分可观察的序列决策问题，提出Q-BIRD框架。核心方法是将量子信念表示集成到强化学习中，编码防御者对攻击者意图的不确定性，使用PPO选择缓解动作。可能应用于自主网络防御系统。

MOLOT System Card: Malicious Operational Logic Observation Transformer

第一作者: Daniil Lopatkin · 方向: 软件安全

06/06 03:10

恶意代码检测静态分析MOLOT系统行为序列建模隐藏英文摘要

MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide...

论文介绍 MOLOT系统是一种静态恶意代码检测方法，适用于缺少包元数据或动态信息的场景。研究问题是如何在静态分析中检测恶意代码，核心方法是将源代码表示为行为序列并映射回源码位置。意义在于增强软件供应链安全。

ScaleDisturb: Exploiting Temporal Asymmetry to Amplify Read Disturbance in Modern DRAM Chips

第一作者: Jikun Wang · 方向: 软件安全

DRAM读干扰RowHammerScaleDisturb时间不对称性隐藏英文摘要

Abstract:DRAM suffers from read disturbance phenomena (e.g., RowHammer and RowPress), where repeatedly accessing or continuously keeping open a DRAM row (aggressor row) induces bitflips in other physically nearby unaccessed rows (victim rows). The disturbance mechanism is practically exploitable from the software stack and worsens across generations with continued density scaling. DRAM read disturbance is highly sensitive to memory access patterns, yet prior work explores read disturbance under only a limited set of access patterns. We present ScaleDisturb, a new DRAM access pattern that can amplify DRAM read disturbance by asymmetrically extending the open time of two aggressor rows. Our rigorous experimental characterization of 196 DDR4 and 3 HBM2 DRAM chips shows that ScaleDisturb (1) leads to bitflips at significantly fewer row activations, compared to state-of-the-art memory...

论文介绍 ScaleDisturb提出一种新的DRAM访问模式，利用时间不对称性放大读干扰。研究问题在于现有读干扰模式覆盖不足，核心方法是不对称扩展开放时间以诱导更多位翻转。意义在于揭示新型内存安全风险。

SHIELD-IDS: Structurally Heterogeneous Ensemble with Integrated Layered Defense for Intrusion Detection Systems

第一作者: Maryam Zaman · 方向: AI 安全

06/05 23:25

入侵检测系统对抗攻击集成学习SHIELD-IDS隐藏英文摘要

Adversarial attacks pose a serious and growing threat to Machine Learning (ML)-based Intrusion Detection Systems (IDS), where imperceptible perturbations to network flow features can systematically mislead classifiers into accepting malicious traffic as benign. The IDS-Anta framework partially addresses this through Z-score normalization, Singular Value Decomposition (SVD), and Multi-Armed Bandit (MAB) classifier selection with Thompson Sampling, yet its classifier pool lacks sufficient structural diversity for robust adversarial resistance. This work introduces IDS-Anta++, which incorporates XGBoost and LightGBM gradient boosting models into the ensemble and wraps the extended pool in a three-layer black-box defense: Isolation Forest anomaly screening, median feature smoothing, and six-way majority voting. Experiments conducted on CIC-IDS-2017, CEC-CIC-IDS-2018, and CIC-DDoS-2019...

论文介绍 针对机器学习入侵检测系统易受对抗攻击的问题，本文提出SHIELD-IDS。核心方法是扩展分类器池以增加结构多样性，并集成三层黑盒防御：异常筛选、特征平滑和多数投票。可能提升IDS的对抗鲁棒性。

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

第一作者: Rishabh Makwana · 方向: 软件安全

越狱攻击视觉语言模型多语言安全评估隐藏英文摘要

Abstract:Vision-Language Models (VLMs) have demonstrated strong performance across multimodal tasks, yet their safety robustness remains an open challenge. While prior work has shown that structured visual prompts such as flowcharts can effectively jailbreak VLMs, existing studies are largely limited to English-centric settings. In this paper, we introduce MLingualFC, a multilingual multimodal benchmark designed to evaluate jailbreak vulnerabilities of VLMs across diverse languages using structured flowchart representations. MLingualFC encodes harmful instructions into flowchart images across five languages (Hindi, Punjabi, Spanish, Romanian, and German). We evaluate state-of-the-art multilingual VLMs, including Qwen2.5-VL, Gemma-4, and Pangea, under a black-box threat model. Our results reveal significant multilingual safety gaps. Flowchart-based attacks achieve high attack success...

论文介绍 本文引入MLingualFC基准，评估多语言视觉语言模型的越狱漏洞。研究问题是现有评估局限于英语，核心方法是使用流程图图像编码有害指令在五种语言中测试。结果揭示多语言安全差距，意义在于推动AI安全研究。

Detecting Aimbot Cheaters in MOGs

第一作者: Salman Shaikh · 方向: 软件安全

瞄准机器人作弊多人在线游戏对抗性补丁作弊检测隐藏英文摘要

Abstract:Multiplayer Online Games have become a multibillion dollar industry in the entertainment sector. However, the presence of cheaters undermines the experience of honest players and devalues the effort of game developers, as it directly affects player retention, competitive integrity, the legitimacy and trustworthiness of a game, and most importantly the overall revenue streams. Among various cheating techniques, visual aimbots represent an emerging threat. They use computer vision models to detect opponents from client screen captures rather than accessing game memory, making them completely undetectable by commercial kernel level anti cheat solutions. In this paper, we introduce PATCH, a novel proactive defense strategy that deploys adversarial patches as in game honeytokens to mitigate the presence of visual aimbot cheaters. Our approach centers on deliberately triggering the...

论文介绍 本文针对多人在线游戏中视觉瞄准机器人作弊问题，提出PATCH防御策略。核心方法是部署对抗性补丁作为蜜令牌，触发作弊者检测。可能应用于游戏反作弊系统，保护游戏公平性。

Human-Centred Risk Mitigation for AI-Mediated Information Manipulation: A SOCMINT Framework Based on Information Manipulation Sets

第一作者: Antonio Scala · 方向: 安全研究

AI 信息操纵SOCMINT 框架信息操纵集风险缓解社会网络攻击隐藏英文摘要

Abstract:AI-mediated information manipulation increasingly takes the form of social cyber attacks that target trust, attention, credibility, reputation, and decision-making rather than only technical infrastructures or isolated false contents. Existing defensive approaches often oscillate between incident-level analysis, which fragments campaigns into weak signals, and attribution-first analysis, which may delay mitigation until responsibility is established. This paper proposes a SOCMINT framework based on Information Manipulation Sets (IMS) as an intermediate operational unit between individual incidents and strategic attribution. Building on the VIGINUM/EEAS use of IMS in counter-FIMI analysis, the framework treats manipulation as a coherent process involving narratives, accounts, infrastructures, temporal patterns, cross-platform migration, synthetic amplification, and cognitive...

论文介绍 该论文针对 AI 介导的信息操纵问题，指出现有防御方法在事件分析和归因间存在局限，可能导致缓解延迟。作者提出基于信息操纵集的 SOCINT 框架，将操纵视为涉及叙述、账户、基础设施、时间模式等的一致过程，作为事件与战略归因之间的中间操作单元。此框架可用于反虚假信息、影响和操纵分析，以提高风险缓解的及时性和有效性。

A Bell-State Extension of Loop-Back Quantum Key Distribution

第一作者: Luis Adrián Lizama-Pérez · 方向: 密码学协议

量子密钥分发Bell 状态扩展Loop-Back 架构安全增强纠缠交换攻击隐藏英文摘要

Abstract:Bidirectional quantum key distribution (QKD) protocols face persistent challenges related to classical disclosure, confinement of the signal space to predictable subspaces, and limited detectability under substitution or entanglement-swapping attacks. In this work, we present a Bell-state extension of the Loop-Back QKD architecture that improves efficiency and detectability while preserving its defining feature of a simplified, measurement-free remote terminal. The protocol employs entangled Bell states together with deterministic local Pauli encoding at the remote node. A central element is that Alice privately prepares and knows the initial Bell state, which serves as a hidden reference enabling her to interpret the Bell-state transition induced by Bob, while preventing an adversary from reconstructing the encoding without access to this reference. By exploiting both intra...

论文介绍 该论文研究双向量子密钥分发（QKD）协议的安全性挑战，如经典泄露和可检测性限制。作者提出一个 Bell 状态扩展的 Loop-Back QKD 架构，使用纠缠 Bell 状态和本地 Pauli 编码，提高效率和可检测性，同时保持远程终端简化无测量的特性。核心是 Alice 私有准备初始 Bell 状态作为隐藏参考，防止对手重构编码，可能增强量子通信安全性。

Parent-Hash DAG: A Cost Analysis of Constant-Time Append for On-Chain Registries

第一作者: Ian C. Moore · 方向: 区块链安全

区块链注册父哈希 DAG成本分析增量 Merkle 树gas 成本隐藏英文摘要

Abstract:Provenance trees are append-only directed acyclic graphs of artifact registrations anchored on a public blockchain, recently introduced as the data substrate of operator-gated provenance infrastructure. Their defining data-structural pattern is a parent-hash directed acyclic graph (PHDAG), in which each append performs a constant number of storage writes to previously-untouched slots. This pattern has not previously been isolated as a standalone primitive, formally bounded with explicit constants, or benchmarked against the standard alternative, the incremental Merkle tree (IMT). We formalize PHDAG append as O(1) in gas cost, independent of registry size and tree depth, and develop a stochastic cost model for IMT in which per-insert cost is a random variable over the leaf index, deriving closed-form expressions for its mean and variance. We validate both analyses empirically...

论文介绍 该论文研究区块链上追加-only 溯源树的数据结构，提出父哈希有向无环图（PHDAG）作为恒定时间追加的原语。作者形式化 PHDAG 的追加操作为 O(1) gas 成本，独立于注册大小和树深度，并与标准增量 Merkle 树（IMT）对比，开发随机成本模型进行基准测试。这为区块链注册提供更高效的数据存储方案，可能优化链上操作成本。

Clinically Grounded Privacy Evaluation of Medical LMs

第一作者: Sasha Ronaghi · 方向: AI 安全

医疗语言模型隐私评估临床基础框架数据泄露对抗性访问隐藏英文摘要

Abstract:Medical language models (LMs) can memorize and reproduce protected health information, but privacy evaluations often focus on recovery of training text rather than disclosure under realistic threat models. We introduce a clinically grounded framework that evaluates leakage along a graded axis of adversarial access, ranging from publicly inferable demographics to leaked note fragments. At each tier, we measure verbatim memorization of patient-specific text and semantic leakage of sensitive diagnoses. Applying the framework to an LM pretrained on 378k clinical notes, we find that routine encounter metadata (i.e. name, date of birth, provider, practice, visit date) elicits high rates of verbatim memorization across a patient's timeline and sensitive-diagnosis recovery (AUROC 0.91 for abortion, 0.81 for HIV). At the same time, exact-match memorization can overstate disclosure: 36%...

论文介绍 该论文针对医疗语言模型（LMs）的隐私风险，提出一个临床基础评估框架，沿对抗性访问等级评估数据泄露，包括可公开推断的人口统计和泄露的笔记片段。框架测量逐字记忆和敏感诊断的语义泄露。应用于预训练于临床笔记的 LM，发现常规元数据能触发高记忆率和敏感诊断恢复，有助于更实际地评估隐私保护。

Safe-RULE: Safe Reinforcement UnLEarning

第一作者: Shixiong Jiang · 方向: AI 安全

安全强化学习强化遗忘数据中毒防御离线学习安全性隐藏英文摘要

Abstract:Offline safe reinforcement learning (Safe RL) enables policy learning without online interactions, making it suitable for safety-critical systems such as robotics systems. However, its reliance on static datasets exposes offline Safe RL to data poisoning attacks, where adversaries inject malicious samples that compromise safety and induce unsafe policy behavior. In this work, we propose a new learning paradigm, named safe reinforcement unlearning (Safe-RULE), used as a defense framework to remove the influence of poisoned data without retraining from scratch or requiring access to the original training environment. We further extend reinforcement unlearning to offline Safe RL by explicitly accounting for both task performance and safety constraints during the unlearning process. Experiments across benchmark Safe RL tasks demonstrate that our approach effectively enhances...

论文介绍 离线安全强化学习依赖静态数据集，易受数据中毒攻击。提出Safe-RULE框架，用于安全强化学习的防御，通过强化遗忘移除中毒数据影响，无需重新训练或原始环境访问，在遗忘过程中显式考虑任务性能和安全约束，增强系统安全性。

Targeting World Models to Compromise Robot Learning Pipelines

第一作者: Ethan Rathbun · 方向: 安全研究

世界模型数据投毒机器人学习管道安全性隐蔽攻击隐藏英文摘要

Abstract:World models have recently seen a rapid growth in both their popularity and capability as more data efficient tools for generating robot training data or simulating real world environments, with many works proposing their integration into the robot learning pipeline. While highly practical, in this work we demonstrate that world models introduce a uniquely stealthy and effective data poisoning entry point into the robot learning supply chain that can result in the deployment of unsafe or otherwise compromised robotic policies despite training on seemingly safe ground truth training data. In contrast to traditional data poisoning techniques which directly implant dangerous trajectories into sold or uploaded datasets, our novel attack methods inject malicious prompts or compromising transition dynamics into visibly safe teleoperated datasets which are only activated once fed...

论文介绍 世界模型作为高效数据工具被集成到机器人学习中，但可能引入隐蔽数据投毒入口。本工作演示新颖攻击方法，将恶意提示或妥协动力学注入看似安全数据集，只在喂入世界模型时激活，揭示机器人学习管道的安全风险，促进安全措施发展。

Benchmarking Empirical Privacy Protection for Adaptations of Large Language Models

第一作者: Bartłomiej Marek · 方向: AI 安全

大语言模型适应差分隐私隐私风险评估数据分布成员推断攻击隐藏英文摘要

Abstract:Recent work has applied differential privacy (DP) to adapt large language models (LLMs) for sensitive applications, offering theoretical guarantees. However, its practical effectiveness remains unclear, partly due to LLM pretraining, where overlaps and interdependencies with adaptation data can undermine privacy despite DP efforts. To analyze this issue in practice, we investigate privacy risks under DP adaptations in LLMs using state-of-the-art attacks such as robust membership inference and canary data extraction. We benchmark these risks by systematically varying the adaptation data distribution, from exact overlaps with pretraining data, through in-distribution (IID) cases, to entirely out-of-distribution (OOD) examples. Additionally, we evaluate how different adaptation methods and different privacy regimes impact the vulnerability. Our results show that distribution...

论文介绍 该论文评估大语言模型（LLMs）适应中的隐私保护实践效果，使用差分隐私（DP）但面临预训练数据重叠问题。作者通过鲁棒成员推断和金丝雀数据提取等攻击，在不同数据分布下基准测试隐私风险。研究显示，数据分布和适应方法影响漏洞，为隐私保护提供实证分析。

The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection

第一作者: Hyunseok Paeng · 方向: AI 安全

06/08 16:38

提示注入攻击检索增强生成安全训练失效推荐系统品牌级抑制隐藏英文摘要

We present a reproducible failure mode of safety training in RAG-based LLM recommendation -- the Injection Paradox -- in which prompt injections embedded in retrieved documents backfire against the attacker, suppressing the target brand below the injection-free baseline. In safety-trained Claude models, documents containing prompt injections suffer a sharp drop in recommendation rate, and this suppression propagates beyond the injected document to unmodified documents of the same brand. In Claude Opus 4.6, the target brand drops from a 54% baseline to zero top-2 recommendations across all 50 trials, even though only 1 of 4 brand documents in the corpus contains an injection. The directional pattern is reproduced in counterfactual experiments and across three brands. A contrasting result across the GPT models tested, where the same injection instead increases recommendations, suggests...

论文介绍 该论文揭示 RAG 基础上 LLM 推荐系统中的一个安全训练失败模式——注入悖论。嵌入文档的提示注入在安全训练的 Claude 模型中反而抑制目标品牌推荐，甚至传播到未注入文档。实验显示品牌推荐率从基准降至零，而在 GPT 模型中则增加推荐，指出安全训练可能引入意外行为。

Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human

第一作者: Emre Turan · 方向: AI 安全

人工回路主观判断非对称成本安全校准隐藏英文摘要

Abstract:As LLM agents begin to take real, irreversible actions (shell commands, file edits, deploys), the standard safety pattern is a human-in-the-loop approval gate: risky actions pause and wait for a person. We argue the gate is the easy part; the hard part is the judgment - which actions to stop - which the field evaluates against two false assumptions: that there is a ground-truth notion of "risky," and that the human reviewer is a perfect, infinitely-available oracle. On a hand-labeled set of 125 adversarially-weighted agent actions we show that (i) reviewers only moderately agree on what is risky (Fleiss' kappa = 0.52), so there is no single correct label; (ii) framing the guard as selective classification under asymmetric cost makes its operating limits measurable, and on hard inputs the guard cannot safely auto-decide; and (iii) when the reviewer is modeled as endogenous...

论文介绍 该研究探讨了基于大语言模型（LLM）的智能体在执行高风险操作时，如何校准其“人类审批”安全机制。研究指出，现有安全机制假设存在明确的“风险”定义且人类审查者是完美的，这与现实不符。作者通过实验表明人类对风险的判断存在中等程度的一致性，并提出将防护机制建模为非对称成本下的选择性分类，从而量化其能力边界。该工作为设计更有效、更现实的智能体安全守卫提供了理论基础。

Cheap Reward Hacking Detection

第一作者: Iván Belenky · 方向: AI 安全

奖励黑客异常检测Transformer 编码器成本效率隐藏英文摘要

Abstract:A small transformer encoder is trained to map Terminal-Wrench trajectories onto a unit sphere where embedding distance approximates the $L_1$ distance between reward and metadata signals. A linear probe on top of that embedding detects reward hacking on the cleaned test split with AUC $0.9467$ and TPR@5%FPR $0.8296$, matching the TW sanitized LLM-as-judge AUC ($0.9510$ on the cleaned split) and exceeding its TPR@5%FPR ($0.7130$ vs $0.8296$) on the same information condition, at roughly four orders of magnitude lower per-trajectory cost. The encoder is not a pure behavior reader: stripping natural-language reasoning from its input at probe time drops AUC to $0.6213$.

论文介绍 本文提出了一种用于检测“奖励黑客”行为的低成本方法。奖励黑客是指智能体利用奖励函数的漏洞获取高奖励但并未完成预期任务。作者训练了一个小型 Transformer 编码器，将智能体的轨迹映射到一个嵌入空间，并利用线性探测器进行检测。该方法在测试集上达到了接近使用大语言模型作为评判器的准确率，但每个轨迹的计算成本低几个数量级。这为大规模监控智能体行为提供了一种可行且高效的工具。

RAILS: Verification-Native Clearing For Agentic Commerce

第一作者: Adrian de Valois-Franklin · 方向: 软件安全

代理商业清算层责任判定智能合约隐藏英文摘要

Abstract:Autonomous agents negotiate, purchase, deploy code, and move funds, but no neutral mechanism determines whether they met their delegated obligation, who is responsible when they did not, or which settlement action follows. This is the agentic clearing problem. Tool protocols (MCP), inter-agent communication (A2A), payment rails (x402), mandate and network agent protocols (AP2, Visa, Mastercard), and settlement-risk standards each assume that determination and none produce it. Clearing is the missing primitive. Payment is not clearing. Authorization is not clearing. LLM-as-judge evaluation is not clearing. Settlement-risk escrow is not clearing: it consumes clearing decisions. RAILS (Real-Time Agent Integrity & Ledger Settlement) is the integrity and clearing layer for agentic commerce, spanning a per-output reliability score, a published reliability record, and a clearing...

论文介绍 随着自主代理能够进行谈判、购买和代码部署，如何判定其是否履行了委托义务以及在失败时如何追责，成为“代理清算”这一关键缺失环节。现有通信、支付等协议均未解决此问题。本文提出了 RAILS（实时代理完整性与账本结算），作为一个完整性与清算层。它通过为每个输出计算可靠性分数、发布可靠性记录并执行结算决策，为代理商业提供了一个中立的责任判定和结算机制。

Uncertainty Principles for the Number Theoretic Transform

第一作者: Giulio Malavolta · 方向: 安全研究

数论变换不确定性原理稀疏性多项式恒等测试隐藏英文摘要

Abstract:Motivated by polynomial identity testing with exponentials (Li and Wu, ITCS'26), we study uncertainty principles for the number-theoretic transform (NTT). We show that the NTT satisfies strong sparsity tradeoffs: For every fixed prime $q$ and for all but finitely many primes $p \equiv 1 \pmod q$ every nonzero $f\in \mathbb F_p^{\mathbb Z_q}$ and its number-theoretic transform $\hat f$ satisfy \[ |\mathrm{Supp}(f)| + |\mathrm{Supp}(\hat f)| \ge q+1. \] Thus, a $k$-sparse function has transform support at least $q-k+1$. As our main technical contribution, we prove a probabilistic version of the above uncertainty principle, averaged over primes $p$, in the regime $p=q^{O(1)}$. As an application, we obtain a black-box identity test for $k$-sparse exponential polynomials of degree at most $d$ with vanishing soundness error, for $q$ moderately larger than $k$.

论文介绍 受指数多项式恒等测试研究的启发，本文研究了数论变换（NTT）的不确定性原理。研究证明了 NTT 满足强稀疏性权衡：对于几乎所有的素数 p，非零函数 f 及其 NTT 变换 f̂ 的支撑集大小之和至少为 q+1。这意味着一个 k 稀疏函数的变换至少有 q-k+1 个非零分量。作为主要技术贡献，作者证明了在 p=q^{O(1)} 区间上关于素数 p 的概率版本不确定性原理，并将其应用于指数多项式恒等测试。

Differentially Private Range Subgraph Counting

第一作者: Xian Chen · 方向: 隐私保护

差分隐私子图计数范围查询图分析隐藏英文摘要

Abstract:Subgraph counting is a fundamental problem in graph analysis. Motivated by practical scenarios where graph analytics are performed on subgraphs induced by selected vertices -- rather than on the entire graph -- and by growing privacy concerns, we initiate the study of differentially private range subgraph counting (DPRSC). The goal is to privately count occurrences of a fixed pattern graph within induced subgraphs defined by multi-dimensional attribute ranges. Unlike classical point counting, subgraph counting is inherently nonlinear and exhibits high sensitivity: a single edge modification can affect many subgraph occurrences. We present the first efficient algorithms for DPRSC with small additive error. Our approach introduces a subgraph projection that reduces DPRSC to weighted orthogonal range counting, enabling the use of range trees and local sensitivity estimation to...

论文介绍 子图计数是图分析的基本问题。本文针对在由多维属性范围定义的顶点诱导子图中进行隐私保护的模式图计数问题，即差分隐私范围子图计数，展开了研究。子图计数具有高灵敏度，单个边的改变可能影响多个子图的出现次数。作者首次为该问题提出了具有小加性误差的高效算法，其核心是引入一个子图投影，将问题归约为加权正交范围计数，从而利用范围树和局部灵敏度估计来设计机制。

Multidimensional Resilience for Electrical Power Systems: Systematic Review, Integrated Index, and Validation under Real-World Cyber-Physical Attack Scenarios

第一作者: Isaac Ortega Romero · 方向: 安全研究

06/06 16:51

电力系统韧性多维度评估跨域耦合混合方法隐藏英文摘要

The accelerating decarbonization of energy systems has transformed electrical power systems into complex infrastructures exposed to threats whose interactions generate systemic vulnerabilities that conventional resilience approaches fail to capture. Although resilience assessment has expanded across multiple dimensions, existing studies largely examine them in isolation or adjacent pairs, leaving cross-dimensional couplings insufficiently explored. This study demonstrates i) that single-dimension assessments fail to capture the degradation produced by simultaneous cross-dimensional failures, ii) the nonlinear amplification emerging when physical, operational, and digital-cyber dimensions are jointly compromised, and iii) the intensification imposed by climatic and economic-regulatory stressors. To this end, we leverage a hybrid quantitative methodology. A PRISMA 2020 review with...

论文介绍 电力系统正面临物理、运行和数字-网络等多维度威胁的复杂交互。传统单维度或相邻维度的韧性评估方法无法捕捉跨域耦合失效的系统性影响。本文系统性地展示了单维度评估的不足，揭示了物理、运行和数字-网络维度同时受损时产生的非线性放大效应，并提出了一个综合性的多维韧性指数。该研究基于混合定量方法，为关键基础设施的韧性评估提供了更全面的视角。

TOMOYO Linux: A Mandatory Access Control Method Based on Application Execution State

第一作者: Toshiharu Harada · 方向: 系统安全

06/06 16:47

强制访问控制应用执行状态意图感知Linux 安全隐藏英文摘要

Existing access control methods grant access requests based on the combinations of applications as subject and files as objects. Therefore intents of applications and the possible effects caused by granting the access requests have not been taken into consideration. In this paper, we propose a new access control method based on application history and intents. With our access control method, system administrators can reduce the risks caused by malicious access attempts and wrong operations. In this paper, the concept and implementation design will be explained as well as the brief evaluation report of TOMOYO Linux, our implementation of the new access control method to Linux.

论文介绍 现有的访问控制方法通常基于主体（应用）和客体（文件）的组合来授权，但未考虑应用的意图以及授权可能带来的潜在影响。本文提出了一种基于应用历史记录和意图的新访问控制方法。该方法允许系统管理员根据应用的行为模式制定策略，从而降低恶意访问尝试或错误操作带来的风险。论文介绍了 TOMOYO Linux 的概念、实现设计以及初步评估报告。

VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation

第一作者: Harshil Patel · 方向: 密码学协议

隐式权威错误处理提示注入变异框架隐藏英文摘要

Abstract:As the Model Context Protocol (MCP) standardizes tool-calling for autonomous agents, it introduces a critical, unexamined attack surface: the error-handling loop. We hypothesize that tool error messages possess implicit authority, triggering corrective reasoning modes that bypass standard safety heuristics. We introduce VATS (Vulnerability Analysis of Tool Streams), a mutation-driven framework that systematically evolves adversarial payloads across seven structural and linguistic dimensions. Our evaluation across four frontier models, Gemini 3.1 Pro, GPT-5.5, GLM-5.1, and Qwen3-Coder, demonstrates that error-path injection triples the success rate of standard indirect prompt injection (IPI), achieving up to 100% compliance in controlled evaluations. We isolate structural positioning (sandwiching instructions within error context) as the most effective exploit vector across all...

论文介绍 模型上下文协议（MCP）在标准化自主代理的工具调用时，引入了一个未被审视的攻击面：错误处理循环。本文假设工具错误消息具有“隐式权威”，能触发纠正性推理模式从而绕过安全检查。作者提出了 VATS 框架，通过系统变异在七个结构和语言维度上生成对抗性载荷。评估显示，错误路径注入使标准间接提示注入的成功率提高了三倍，在某些模型上可达 100% 成功率，其中指令被嵌入错误上下文的“三明治”结构最为有效。

FADRW: A Feature-Aware Modulated and Dynamically Reweighted Loss for Few-Shot Linguistic Steganalysis

第一作者: Shuo Liu · 方向: 安全研究

语言隐写分析少样本学习损失函数特征感知动态重加权隐藏英文摘要

Abstract:The ubiquity of social media platforms facilitates malicious linguistic steganography, posing significant security risks. However, detection is severely hampered by two fundamental issues during model training. Firstly, extreme class imbalance (less than 1% steganographic samples) induces a strong decision bias. Secondly, the invisibility of generative steganography means its features are nearly indistinguishable from benign text; this similarity, compounded by their extreme rarity, leads to severe feature marginalization, where faint steganographic signals are completely overwhelmed. To directly address these optimization-level challenges, we propose FADRW (Feature-Aware Modulated and Dynamically Reweighted Loss), a novel loss function framework engineered for few-shot steganalysis. FADRW employs Dynamic Reweighting to progressively counteract decision bias, and a...

论文介绍 该研究针对少样本语言隐写检测中的类不平衡和特征边缘化问题，提出FADRW损失函数框架。该方法通过动态重加权逐步纠正决策偏差，并引入特征感知调制来增强微弱隐写信号。这有助于提升检测模型在社交媒体恶意隐写场景下的性能。