2026-06-12

MHOT: Height-Optimized Authenticated Data Structure for Blockchain State Commitment

第一作者: Sipeng Xie · 方向: 密码学协议

区块链认证数据结构MPT状态承诺MHOT隐藏英文摘要

Abstract:State root computation dominates (78%) blockchain block processing time. Ethereum's canonical authenticated data structure, i.e., Merkle Patricia Trie (MPT), suffers from severe tree-height growth and is vulnerable to \textit{Nurgle attacks} (SP'24), where adversaries inflate path depth via hash collisions and degrade system performance at negligible cost. Existing defenses increase node fanout (span) to bound tree height, but higher span inflates proof size exponentially. Prior work mitigates this trade-off using vector commitments, at the cost of trusted setup or expensive verification. We present \textsc{Mhot}, a height-optimal authenticated data structure for blockchain state commitment that preserves standard hash-based verification without trusted setup. Unlike MPT's fixed-prefix indexing, which couples span and fanout exponentially, \textsc{Mhot} indexes by...

论文介绍 以太坊的Merkle Patricia Trie在状态根计算中存在树高增长问题，且易受「Nurgle攻击」，即对手通过哈希碰撞膨胀路径深度，以极低成本降低系统性能。现有防御通过增加节点扇出限制树高，但会导致证明大小指数增长。本文提出MHOT，一种高度优化的认证数据结构，它通过可变高度索引，无需可信设置即可实现最优树高并保持基于标准哈希的验证。

A VPN-as-a-Service Tailored Enabler for Computing-constrained Environments

第一作者: Carolina Fernández-Martínez · 方向: 系统安全

零信任云原生VPN即服务实验基础设施安全隔离隐藏英文摘要

Abstract:Industry has embraced Zero Trust (ZT) architectural tenets and implementations for cloud-native environments, following stricter security requirements to both internal and external tenants. Among others, these approaches combine fine-grained identity management and monitoring for both inventorying and better analysing the devices' security posture for overall protection, along with strict separation of concerns and isolation to enforce minimal privilege. Networking-wise, ZT approaches rely as well on isolation and least privilege; enacted by separate, secure tunnels per tenant connecting to a given infrastructure. Such implementations can also be applied to the connectivity within and towards experimental infrastructures. In this sense, this work contributes the design and evaluation of a cloud-native VPN-as-a-Service (VPNaaS) that can be (i) easily orchestrated to deploy...

论文介绍 本研究针对计算能力受限环境（如实验基础设施）的安全连接需求，设计并评估了一种云原生的「VPN即服务」系统。该系统遵循零信任架构原则，支持按需编排部署，旨在为不同租户提供安全、隔离的网络隧道，以实现精细的身份管理和最小特权访问控制，从而增强云原生环境下的整体安全态势。

T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking

第一作者: Jian-Ping Mei · 方向: 安全研究

模型水印模型提取攻击知识产权保护排练训练鲁棒性隐藏英文摘要

Abstract:Model watermarking safeguards AI model intellectual property by embedding distinctive knowledge that induces unique behavioral signatures. The primary technical challenge lies in ensuring watermark robustness against various post-processing attacks on the watermarked model. Model extraction attacks emerge as the most severe threat, where adversaries exploit prediction outputs to train surrogate models that illegally replicate the original model's functionality. In this work, we propose a rehearsal-based watermark embedding framework to enhance the robustness of model watermarks against model extraction attacks. By simulating the extraction process, our method leverages the loss of a \textit{simulated stolen model} on a trigger set as a training signal to fine-tune the watermark knowledge within the target model. This fine-tuning step encourages the watermark to be embedded in...

论文介绍 针对模型提取攻击对AI模型知识产权构成的严重威胁，本文提出了一种基于排练的模型水印嵌入框架。该方法通过模拟模型提取过程，利用模拟窃取模型在触发集上的损失来微调目标模型中的水印知识，旨在将水印嵌入模型内部更不易被提取的特征中，从而提升水印在面对模型提取攻击时的鲁棒性。

Can Open-Source LLM Agents Replace Static Application Security Testing Tools? An Empirical Assessment

第一作者: Derek Yohn · 方向: AI 安全

06/10 13:31

LLM代理静态应用安全测试开源模型代码漏洞检测实证评估隐藏英文摘要

This paper explores the value of agentic AI tools for cybersecurity purposes. We evaluate the efficacy of a general-purpose GenAI Large Language Model- (GenAI-) based agent when powered by three different Ollama-hosted general-purpose open source models. We assess each agent's performance using precision, recall, false positive count, and a calculated composite score based upon the interplay of the captured metrics, against the baseline performance of an existing, vetted Static Application Security Testing (SAST) tool, Bandit. Our findings refute the notion that a modern open-source GenAI LLM-based agent is currently suitable for the specialized task of SAST scanning under realistic conditions.

论文介绍 本文通过实证研究评估了基于开源大语言模型的通用AI代理在网络安全任务中的效能。研究将其在代码漏洞扫描（静态应用安全测试，SAST）任务上的表现，与经过验证的专用工具Bandit进行了对比。结果表明，在现实条件下，当前通用开源LLM代理尚不适合执行专门的SAST扫描任务。

Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security

第一作者: Tu Lan · 方向: 软件安全

LLM代理技能安全运行时审计动态分析安全标签隐藏英文摘要

Abstract:Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets, persistent state, or multi-step tool interactions. This makes purely static vetting brittle. We present Runtime Skill Audit (RSA), a dynamic analysis method that audits skills by asking what the skill-mediated agent actually does under targeted runtime conditions. Instead of testing every skill with the same generic tasks, RSA profiles risk-relevant interfaces, prepares the execution context needed to exercise them, and assigns security labels from the resulting trace evidence. We instantiate RSA on OpenClaw and evaluate it on 100 skills against representative static baselines. RSA achieves...

论文介绍 大语言模型代理的技能机制引入了新的恶意行为隐藏点，且静态审查难以发现仅在特定运行时条件下才显现的危害。为此，本文提出了「运行时技能审计」方法。RSA是一种动态分析方法，它通过构造目标运行时条件来主动测试技能，并根据执行痕迹证据分配安全标签，从而更有效地识别技能中的安全风险。

A Robust Framework for Sybil Attack Detection in Vehicular Ad Hoc Networks

第一作者: Md. Sadmin Tahmid Khan · 方向: 网络安全

06/10 13:20

车载自组网女巫攻击攻击检测GPS轨迹误报率隐藏英文摘要

Sybil attacks create an illusion of traffic congestion by utilizing fake identities, which undermines the reliable and safe operation of vehicular ad hoc networks (VANETs). Existing detection mechanisms struggle to effectively handle Sybil attacks as they are (i) susceptible to high false positive rates (FPR) due to the overlapping trajectories of both Sybil and legitimate vehicles, (ii) not practical for real-world deployment due to manual calibrations with ground data, (iii) ineffective for sparse distribution of roadside units (RSUs) and vehicles as they depend heavily on the presence of both, and (iv) inefficient due to computational overheads. This paper addresses these shortcomings and proposes a robust framework to tackle these issues. The proposed scheme reduces the FPR by utilizing GPS location data, enabling the construction of more accurate and distinguishable trajectories...

论文介绍 针对车载自组网中女巫攻击利用虚假身份制造交通拥堵假象的问题，现有检测方法存在误报率高、不实用或计算开销大等缺陷。本文提出一个鲁棒的检测框架，通过利用GPS位置数据构建更精确和可区分的车辆轨迹，以有效降低误报率，并减少对路侧单元密集部署和手动校准的依赖。

Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

第一作者: Kazuki Iwahana · 方向: 安全研究

06/10 12:26

后门攻击后门移除大语言模型内部机制虚拟后门隐藏英文摘要

Backdoor attacks pose a serious threat to the safety and reliability of Large Language Models (LLMs), as they cause models to behave normally on clean inputs while producing attacker-specified responses when hidden triggers are present. Removing such unknown backdoors is particularly challenging when the defender does not know the backdoor attack types or the internal mechanisms formed through backdoor training. In this work, we propose a simple but effective backdoor removal method based on shared internal mechanisms across different backdoors. First, we show that different backdoors with the same task (attack objective) induce similar trigger-activated changes in the internal activations. Motivated by this observation, our method intentionally embeds a backdoor with a known trigger (\emph{dummy backdoor}) and then removes it through further fine-tuning on dummy-triggered inputs...

论文介绍 针对大语言模型中未知后门难以移除的挑战，本文提出了一种基于共享内部机制的防御方法。研究发现，具有相同攻击目标的后门会诱发模型内部激活相似的变化。基于此，该方法先故意嵌入一个带有已知触发器的「虚拟后门」，然后通过对触发输入进行微调来移除它，从而连带清除未知后门。

Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure

第一作者: Jun He · 方向: 系统安全

智能体基础设施访问控制证书绑定运行时准入策略执行隐藏英文摘要

Abstract:Agentic infrastructure introduces a critical control-plane authorization problem: non-deterministic reasoning systems can propose high-stakes mutations to production resources, yet existing security mechanisms -- such as identity and access management (IAM), policy engines, consensus protocols, and audit logs -- either enforce static, context-unaware permissions or merely record actions post-execution. This paper introduces the Sovereign Assurance Boundary (SAB), a certificate-bound runtime admission layer for autonomous execution authority. SAB intercepts agent proposals at an assurance airlock, compiles them into typed execution contracts $C$, and binds these contracts to cryptographic evidence digests $H(E)$ and policy versions. The contracts are then routed through consequence-aware certification paths. Upon successful admission, the system emits a signed Sovereign...

论文介绍 智能体基础设施面临非确定性推理系统对生产资源提出高风险变更的授权难题。现有的身份和访问管理等机制存在静态或事后审计的局限。本文提出「主权保障边界」，作为一个基于证书绑定的运行时准入层，在智能体提案执行前进行拦截，将其编译为带类型的执行契约，并绑定加密证据和策略版本，以实现后果感知的实时认证。

Defense Against Prompt Inversion Attacks: An Information-Theoretic Approach for LLM Collaborative Inference

第一作者: Sayedeh Leila Noorbakhsh · 方向: AI 安全

协作推理提示反转攻击信息论隐私保护边云协同隐藏英文摘要

Abstract:Collaborative edge-cloud inference enables resource-constrained devices to leverage large language models (LLMs) by offloading partial computation to cloud servers. However, transmitting intermediate activations exposes sensitive user prompts to prompt inversion attacks, where an adversary reconstructs the original input from shared representations. Existing defenses rely largely on heuristic perturbations or empirical tuning, offering limited theoretical understanding of privacy leakage and its interaction with utility and latency constraints. We propose an information-theoretic defense framework for prompt inversion in collaborative LLM inference. Our approach learns privacy-preserving representations by explicitly minimizing the mutual information between intermediate activations and the input prompt while maintaining task utility under computational constraints. We derive...

论文介绍 在边云协作的大语言模型推理中，传输中间激活可能使用户提示面临提示反转攻击的风险。现有防御方法缺乏理论依据。本文提出一个信息论防御框架，其核心是通过学习隐私保护表示，在维持任务效用的同时，显式最小化中间激活与输入提示之间的互信息，从而在理论上为抵御此类攻击提供基础。

A Deterministic Forensic Preprocessing Framework for Heterogeneous Network Datasets: Formal Foundations, Implementation, and Empirical Validation

第一作者: Ravi Chaudhary · 方向: 网络安全

异构网络数据集数字取证预处理框架确定性归一化隐藏英文摘要

Abstract:Digital forensic investigations increasingly depend on preprocessing heterogeneous network evidence from intrusion detection systems, IoT devices, and enterprise traffic logs. Incompatible schemas and timestamp formats hinder evidence correlation and timeline reconstruction, while current ad hoc approaches offer no mechanism to verify consistency across runs or analysis, creating reproducibility gaps that challenge evidence admissibility. This paper introduces a deterministic forensic preprocessing framework that converts heterogeneous network datasets into a reproducible canonical form. The framework formalises three preprocessing transformations: schema normalisation, temporal normalisation, and provenance tracking. These transformations are specified using set-theoretic definitions and supported by four theorems establishing determinism, information preservation, and...

论文介绍 数字取证调查依赖于异构网络证据的预处理，但不兼容的模式和时间戳格式导致可重复性缺口。本文提出一个确定性取证预处理框架，通过模式归一化、时间归一化和来源跟踪，将异构数据集转换为可重复的规范形式。该框架使用集合论定义形式化转换，并通过定理确保确定性和信息保留，以支持证据关联和时间线重建，提升数字取证的可采纳性。

Privacy-Preserving Federated Autoencoder for ECG Anomaly Detection on Edge Devices

第一作者: Kaan Arda Akyol · 方向: 系统安全

隐私保护联邦学习自动编码器ECG异常检测边缘设备隐藏英文摘要

Abstract:Continuous electrocardiography (ECG) monitoring could surface rhythm abnormalities before they escalate into cardiovascular events. However, a deployable system must satisfy three requirements simultaneously: legal-grade privacy (GDPR, HIPAA), real-time inference on constrained edge hardware, and detection quality under non-IID cross-hospital data. We design and evaluate an end-to-end federated system addressing all three for unsupervised 12-lead ECG anomaly detection on PTB-XL dataset, combining three autoencoder families (VanillaAE, ConvAE, VAE), Flower-based federated averaging (FedAvg) across ten simulated hospitals, client-side differentially private SGD (DP-SGD) with a Rényi-DP accountant, and 8-bit integer (INT8) post-training quantization with Raspberry Pi 4 benchmarking. Our main contributions are: an empirical characterization of how these mechanisms compose...

论文介绍 连续ECG监测可及早发现心律异常，但部署需同时满足隐私保护、边缘实时推理和非独立同分布数据检测要求。本文设计端到端联邦系统，在PTB-XL数据集上结合三种自动编码器、联邦平均、客户端差分隐私SGD和INT8量化，评估其在十家模拟医院间的性能，以实现隐私保护且高效的ECG异常检测。

WHET: Welding Homomorphic Encryption to Accelerator Architectures

第一作者: Jongmin Kim · 方向: 密码学协议

06/10 09:04

全同态加密硬件加速内存优化架构感知WHET隐藏英文摘要

Fully homomorphic encryption (FHE) enables computations on encrypted data without decryption, offering strong data privacy at the expense of substantial computational and memory overheads. Prior efforts have steadily improved FHE performance through cryptographic and algorithmic enhancements or hardware acceleration, yet these two directions have progressed largely in isolation, hindering the full exploitation of available hardware capabilities. This work presents WHET, which introduces memory-centric, architecture-aware optimizations to better align cryptographic and algorithmic constructions with FHE accelerator architectures. We identify conventional FHE constructions as major sources of excessive working sets and heavy off-chip memory traffic. We propose accelerator-specific techniques, including fine-grained coefficient-to-slot transformation, plaintext compression, and...

论文介绍 全同态加密提供强数据隐私，但伴随高额计算和内存开销。现有密码学和硬件加速研究进展分离。本文提出WHET框架，引入内存中心、架构感知优化，对齐密码学构造与FHE加速器架构，减少工作集和芯片外内存流量。技术包括系数到槽的细粒度变换和明文压缩，以加速FHE计算。

PriME-Deal: Privacy-Preserving Bilateral Data Trading with Efficient Matchmaking and Auditable Fair Exchange on Blockchain

第一作者: Jie Zhang · 方向: 密码学协议

隐私保护数据交易区块链公平交换零知识证明隐藏英文摘要

Abstract:Bilateral attribute-based access control for data trading must hide policies, provide cryptographic fairness, and avoid trusted third parties. Existing solutions either leak policy information, incur super-linear costs, or rely on trusted dispute resolution. We present PriME-Deal, a non-interactive protocol that simultaneously achieves policy-hiding bilateral matching, efficient threshold access control, and auditable fair exchange on public blockchains. The seller embeds a secret token under the buyer policy into an oblivious key-value store with pseudorandom masking; the buyer reconstructs the token locally via tag-based probing, eliminating combinatorial enumeration, and proves correctness in zero-knowledge. Fair exchange is enforced through a collateralized on-chain reveal with a cryptographic audit that penalizes misbehaviour without trusted parties. We prove security in...

论文介绍 数据交易中的隐私保护需隐藏访问策略并保证公平交换。现有方案存在信息泄露或依赖可信第三方。本文提出PriME-Deal，一个非交互协议，通过卖方在买方策略下嵌入秘密令牌到不经意存储，买方本地探测并证明正确性。公平交换通过区块链抵押揭示和加密审计实现，无需可信方，提升安全性和效率。

VIPIR: A Versatile GPU Framework for Integrating Private Information Retrieval Protocols

第一作者: Jongmin Kim · 方向: 安全研究

06/10 08:40

私有信息检索GPU加速数据压缩协议整合VIPIR隐藏英文摘要

While private information retrieval (PIR) enables private database services by fully concealing access patterns, it simultaneously requires high computational throughput, large memory capacity, and substantial memory bandwidth. We introduce VIPIR, a versatile GPU framework that co-designs PIR protocols with GPU acceleration. We develop a unified analytic model showing that state-of-the-art PIR protocols fall into two categories with complementary limitations, and propose two protocols that flexibly combine techniques across these categories, overcoming the limitations of both classes. These protocols incorporate a GPU-friendly data compression method called expansion-based ring packing (ExpPack), which offers a high degree of parallelism and minimal communication cost. VIPIR applies further optimizations to core operations, including number-theoretic transforms (NTTs) and various...

论文介绍 私有信息检索保护数据库查询隐私，但需要高计算和内存资源。本文介绍VIPIR，一个通用GPU框架，协同设计PIR协议与GPU加速。开发统一模型分析协议局限，提出灵活组合的新协议，并采用扩展环打包压缩方法，实现高并行和低通信成本，优化核心运算以提升性能。

Hiding the Trees in the Forest: Building Network Covert Channels with Hash-Based Covert Carrier Filtering

第一作者: Zexiao Zou · 方向: 网络安全

网络隐蔽信道哈希过滤抗审查载体选择安全性隐藏英文摘要

Abstract:As an effective anti-censorship mechanism, network covert channels can provide data privacy protection and ensure communication security. However, the covertness of existing network covert channels primarily depends on the secrecy of their covert algorithms. With the increasing depth of research in this field, the difficulty of breaking such algorithms has gradually decreased. Once the algorithm is exposed, the network covert channel can be easily detected by adversaries. To address this issue, this paper proposes a covert carrier filtering strategy based on the hash. In this strategy, a key-dependent filtering rule is introduced during the construction of the network covert channel, enabling the communicating parties to randomly and dynamically filter a sparse subset from the carrier set as the covert carrier set. This strategy not only enhances the randomness of carrier...

论文介绍 网络隐蔽信道提供数据隐私和通信安全，但其隐蔽性依赖算法保密性，一旦暴露易被检测。本文提出基于哈希的隐蔽载体过滤策略，通过密钥相关过滤规则，让通信方随机动态地从载体集中筛选稀疏子集作为隐蔽载体。这增强了载体随机性和隐蔽性，提升抗审查能力。

Evaluating and Combating the Impact of Concept Drift on the Performance of Machine Learning-Based Phishing Detection Systems

第一作者: Warren Fernando · 方向: AI 安全

概念漂移钓鱼检测机器学习电子邮件安全模型适应隐藏英文摘要

Abstract:The expansion of the digital domain has resulted in a substantial increase in digital communication, with email emerging as one of the most prominent channels. The proliferation of email communication is apparent in both professional and personal contexts, thereby creating numerous vulnerabilities for malicious actors to exploit. Spam emails, a form of unsolicited correspondence often bearing malicious intent towards recipients, have been an ongoing challenge for email users since the inception of email technology, and this problem has been exacerbated by the growth of the digital landscape. Email spam filters are integral components of email clients, engineered to identify potentially harmful messages and alert users to their malicious content. Phishing, frequently the initial phase of malware-based attacks, is evolving rapidly, with malware becoming increasingly...

论文介绍 电子邮件钓鱼攻击不断演变，导致基于机器学习的检测系统面临概念漂移问题，性能下降。本文评估概念漂移对系统性能的影响，并研究对抗策略，以增强检测系统的适应性和有效性，应对动态威胁环境，提高钓鱼邮件识别的鲁棒性。

JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization

第一作者: Ge Shi · 方向: 安全研究

越狱攻击提示优化大型语言模型工具辅助安全性评估隐藏英文摘要

Abstract:Jailbreak attacks expose persistent safety weaknesses in large language models (LLMs), but existing stateless single-turn methods face a trade-off: hand-crafted prompts are expressive but static, while iterative prompt optimization can adapt but often relies on low-level mutations that require many target queries. We propose JailbreakOPT, a tool-assisted framework for improving iterative single-turn jailbreak prompt optimization. JailbreakOPT organizes diverse atomic jailbreak prompts into an attack tool library and composes them through a unified intra-episode optimization abstraction to generate stronger standalone attack prompts. To reuse experience across attack episodes, JailbreakOPT further frames tool selection as a contextual bandit problem and applies contextual Thompson sampling to guide exploration and exploitation based on past outcomes. Experiments across multiple...

论文介绍 越狱攻击暴露大型语言模型的安全弱点，但现有单轮方法难以兼顾表达性和适应性。本文提出JailbreakOPT，一个工具辅助框架，将多样越狱提示组织为库，通过统一优化抽象组合生成强攻击提示。进一步将工具选择建模为上下文老虎机问题，使用汤普森采样利用历史经验，优化提示生成效率。

MPC-Patch-Bench: Security-Aware LLM Code Patch for Multi-Party Computation

第一作者: Yukuan Zhang · 方向: 密码学协议

安全多方计算大语言模型代码修补基准测试加密安全隐藏英文摘要

Abstract:Repository-level benchmarks for evaluating Large Language Model (LLM) code repair on Secure Multi-Party Computation (MPC) software do not yet exist, and directly transplanting general-purpose benchmarks such as SWE-bench fails on three structural fronts: (i) MPC repositories are dominated by generic Python infrastructure rather than cryptographic logic; (ii) high-value MPC fixes lack the standardized tests rigid extraction pipelines require; and (iii) standard fail-to-pass evaluation is insufficient for code that must also be cryptographically safe. MPC is increasingly deployed for privacy-preserving machine learning, biomedical collaboration, and secure analytics. Existing MPC-specific code-synthesis efforts cover only operator-level or single-framework tasks; evaluating LLM agents on real repository-level MPC repair instead demands MPC-aware data curation and a verifier...

论文介绍 当前缺乏用于评估大语言模型在安全多方计算代码修复方面能力的存储库级基准。本文指出了通用基准（如SWE-bench）在MPC领域失效的三大结构性问题，并提出MPC-Patch-Bench，一个专门设计的安全感知基准，旨在解决MPC仓库以通用基础设施为主、高价值修复缺乏标准测试，以及需要兼顾功能正确性与密码学安全性的评估难题。该工作为在隐私保护机器学习等场景中部署MPC的LLM代码智能体提供了评估基础。

When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines

第一作者: Xi Nie · 方向: AI 安全

06/09 12:45

检索增强生成语料投毒分块与重排序对抗攻击AI安全隐藏英文摘要

Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate downstream model outputs through malicious knowledge injection. Existing studies mainly evaluate poisoning under simplified retrieval settings, overlooking practical RAG pipelines involving document chunking, dense retrieval, reranking, and grounded generation. In this paper, we revisit corpus poisoning under realistic multi-stage retrieval pipelines and show that many existing attacks substantially degrade after reranking despite achieving high retrieval-stage relevance. We identify retrieval granularity mismatch as a key reason for this failure: document-level adversarial signals are often fragmented during chunking, while rerankers favor locally coherent and answer-bearing passages rather than globally optimized semantic similarity. Based on this observation, we propose...

论文介绍 检索增强生成系统易受语料投毒攻击。本文研究了在包含文档分块、密集检索、重排序和基于内容生成的现实多阶段检索流水线下，现有攻击的性能会大幅下降。研究发现，检索粒度不匹配是失败的关键原因：文档级的对抗信号在分块时被分割，而重排序器倾向于局部连贯且包含答案的段落。基于此观察，作者提出了针对分块和重排序流水线的增强攻击方法。

A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents

第一作者: Krti Tallam · 方向: 安全研究

06/11 00:54

AI智能体运行时治理参考架构企业安全委托链隐藏英文摘要

Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls -- access control, data-loss prevention, perimeter inspection -- governed crossings of that boundary. Production AI agents dissolve this assumption. An agent reads context, calls tools, invokes connectors, and modifies systems of record on an enterprise's behalf, so risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized. Existing policy engines do not extend to this regime: they evaluate request-time decisions against atomic principals, where agentic systems require stateful evaluation against composite principals whose authority attenuates through delegation chains. We present a reference architecture for the runtime governance of production agents, built from four composable...

论文介绍 生产环境中的AI智能体能主动读取上下文、调用工具并修改系统记录，使得风险从静态数据边界转移到动态的工作流内部。传统基于原子请求的策略引擎无法有效治理这种需要评估委托链中权威递减的复合主体系统。本文提出一个由四个可组合平面构成的参考架构，用于生产AI智能体的运行时治理，旨在应对智能体工作流中因序列化授权操作带来的新型风险。

Reinforcement Learning Disrupts Gradient-Based Adversarial Optimization

第一作者: Xinhai Zou · 方向: AI 安全

06/10 23:53

强化学习对抗鲁棒性梯度攻击正则化图像分类器隐藏英文摘要

Gradient-based adversarial attacks remain a dominant threat to deep neural networks (DNNs), as they exploit gradient information to efficiently optimize adversarial perturbations. To address this, we investigate whether reinforcement learning (RL) training can disrupt the gradient structure used by attackers by training image classifiers with policy-gradient objectives and epsilon-greedy exploration. Through systematic experiments across CIFAR-10, CIFAR-100, and ImageNet-100 with multiple architectures, we find that RL-trained classifiers significantly disrupt gradient-based adversarial optimization. To explain this, we conduct a comprehensive mechanism analysis using loss landscape visualization, static and dynamic gradient indicators, and predictive entropy. Our analysis reveals that RL acts as an implicit regularizer, producing models with highly unstable gradient directions and...

论文介绍 基于梯度的对抗攻击通过利用梯度信息高效优化扰动，对深度神经网络构成主要威胁。本文研究了使用强化学习训练图像分类器是否能破坏攻击者所依赖的梯度结构。实验表明，RL训练的分类器能显著干扰基于梯度的对抗优化。机制分析揭示，RL充当了隐式正则化器，产生了具有高度不稳定梯度方向的模型，从而阻碍了对抗扰动的梯度优化过程。

Mind your key: An Empirical Study of LLM API Credential Leakage in iOS Apps

第一作者: Pinran Gao · 方向: 软件安全

大语言模型API密钥泄露iOS应用安全动态分析实证研究隐藏英文摘要

Abstract:The rapid integration of large language models (LLMs) into mobile applications has introduced a new class of credential security risk: leaked credentials that grant unauthorized access to LLM inference services, causing financial damage to developers. Prior work on credential leakage has focused primarily on Android apps; to date, no empirical study has systematically investigated LLM API key leakage in iOS applications. We present the first in-depth empirical study of API key leakage in LLM-integrated apps. We construct a high-quality dataset of 444 iOS applications, filtered from 1092 candidates through a standardized process, and develop LLMKeyLens, a dynamic analysis framework that detects LLM API key leakage via traffic interception, provider-specific key extraction, and active validity confirmation, requiring neither source code access nor binary decryption. Our analysis...

论文介绍 集成大语言模型的移动应用存在API密钥泄露的新型安全风险。本文首次对iOS应用中LLM API密钥泄露进行了深入的实证研究。作者构建了一个经过标准化流程筛选的数据集，并开发了LLMKeyLens动态分析框架，该框架通过流量拦截、特定供应商密钥提取和有效性确认来检测泄露，无需源代码或二进制解密。研究揭示了iOS应用中此类凭证安全问题的现状。

Undefined Behavior in C and C++: An Experiment With Desktop Use Cases

第一作者: Jukka Ruohonen · 方向: 软件安全

未定义行为C/C++实证研究编译器消毒桌面环境隐藏英文摘要

Abstract:Undefined behavior is idiomatic to C and C++ programming; such behavior is a use of an erroneous program construct for which the languages impose no requirements, such as integer overflows. The paper presents an empirical experiment seeking to probe the extent of undefined behavior executing underneath typical desktop use of a Linux distribution. The analysis is based on an undefined behavior sanitizer implemented in a compiler. According to the results, undefined behavior is common. By completing 59 simple experimental tasks, nearly 11 thousand unique undefined behavior warnings were generated by 32 unique programs and libraries written in C or C++. Of these warnings, most were associated with the Mesa graphics library and generated by interacting with graphical user interfaces. Merely logging into the GNOME desktop environment generated over 500 unique warnings. Of all...

论文介绍 未定义行为是C/C++语言的固有特性。本文通过一项实证实验，探究在典型的Linux桌面使用场景下未定义行为的发生程度。研究基于编译器的未定义行为消毒器进行分析。结果表明，未定义行为相当普遍：在完成59个简单实验任务时，由32个C/C++程序和库生成了近1.1万个独特的警告，其中大多数与Mesa图形库及图形用户界面交互相关，仅登录GNOME桌面环境就产生了超过500个警告。

Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers

第一作者: Jun Wen Leong · 方向: AI 安全

分布偏移检测共形预测安全分类器在线适应错误率控制隐藏英文摘要

Abstract:We present an online monitoring system for distributional shift in deployed safety classifiers, using calibrated sequential statistics to detect when a classifier has moved out of distribution. Upon detection, a conformal abstention layer adapts decision thresholds to recover a target error rate epsilon=0.1. In a pre-registered factorial evaluation (4 classifiers x 5 shift conditions x 20 seeds x 2 window sizes, 800 cells), the system achieves 86.6% valid detection (693/800, 95% CI [84.1%, 88.8%]) with mean latency of 39.5 steps. Detection holds across three ground-truth regimes: synthetic onset (86.6%), real temporal jailbreaks (85%, 17/20), and GCG adversarial attacks. Weighted conformal prediction recovers up to 39 pp of lost coverage for DeBERTa (ESS=46/300) but collapses for all other classifiers (ESS~300): logistic density ratio estimation achieves perfect source/target...

论文介绍 本文提出了一个用于监控已部署安全分类器分布偏移的在线监测系统。系统使用校准的序列统计量检测分类器是否脱离原始分布。一旦检测到偏移，一个共形弃权层会自适应地调整决策阈值，以恢复目标错误率。实验在多类分类器、偏移条件和窗口大小组合下验证了系统在检测合成偏移、真实越狱攻击和对抗攻击时的有效性，并通过加权共形预测等技术尝试恢复模型的覆盖率。

Image Quality Assessment of Identity Cards Using Measures from Open Face Image Quality

第一作者: Gregor Grote · 方向: 安全研究

图像质量评估身份证件远程验证人脸识别质量呈现攻击检测隐藏英文摘要

Abstract:This paper addresses the challenge of assessing image quality in ID cards in remote verification systems by applying capture-related quality measures from the Open Face Image Quality (OFIQ) standard to ID card images. Our preprocessing pipeline includes corner detection, perspective normalization, and comprehensive foreground masking to ensure accurate and unbiased quality measure computation. We evaluate the effectiveness of these measures by analyzing their correlation with the performance of three presentation attack detection (PAD) algorithms across four diverse ID card datasets, where two datasets contain bona fide, i.e. pristine, images and two contain printed mock ID cards. Our results suggest that quality assessment based on some OFIQ measures can significantly improve PAD performance.

论文介绍 本文将开放人脸识别质量标准中的捕获相关质量度量应用于身份证件图像，以解决远程验证系统中证件图像质量评估的挑战。作者设计了一个包含角点检测、透视校正和前景掩码的预处理流程，并通过分析这些质量度量与三种呈现攻击检测算法在四类证件数据集（含真实与伪造图像）上的性能相关性，验证了其有效性。研究表明，基于部分OFIQ度量的质量评估可显著提升攻击检测性能。

Feature-Aligned Speech Watermarking for Robustness to Reconstruction Distortions

第一作者: Haiyun Li · 方向: 安全研究

音频水印特征对齐鲁棒性语音重建隐藏英文摘要

Abstract:Audio watermarking aims to embed identifiable information into audio while remaining imperceptible. Existing methods adopt high-fidelity, low-energy designs to preserve perceptual quality, but the resulting watermarks lack robustness under suppression by speech reconstruction models. Improving robustness is challenging due to the inherent robustness-fidelity trade-off in existing designs, where increasing watermark energy improves robustness but reduces fidelity. To address this problem, we propose a feature-aligned watermarking method that aligns the watermark with the original speech feature distribution, allowing higher watermark energy to improve robustness while preserving imperceptibility. We use a pretrained speech codec to generate a pseudo-speech watermark and fuse it into the spectrogram of the input audio, with VAD loss and perceptual losses guiding embedding within...

论文介绍 现有音频水印方法常因鲁棒性与保真度的权衡而易受语音重建干扰。本文提出特征对齐水印方法，通过对齐水印与原始语音特征分布，允许更高能量嵌入以提升鲁棒性。该方法利用预训练语音编解码器生成伪语音水印，融合到输入音频频谱图中，并通过 VAD 损失和感知损失优化嵌入过程，从而在保持不可感知性的同时增强对抗重建失真的鲁棒性。

Toward Trustworthy AI: Multi-Target Adversarial Attacks and Robust Defenses for Continuous Data Summarization

第一作者: Yuefang Lian · 方向: AI 安全

可信 AI对抗攻击数据摘要DR-次模优化鲁棒防御隐藏英文摘要

Abstract:Trustworthy AI requires reliable data-processing pipelines, not only robust downstream predictive models. As an upstream component, data summarization determines which information is retained and passed to subsequent learning or decision modules. Therefore, adversarial perturbations to the summarization process can compromise trustworthy AI in an upstream manner: they may alter the selected summary, reduce its representativeness, and further degrade the utility of subsequent learning tasks. In this paper, we study adversarial attacks on continuous data summarization under similarity-level perturbations through DR-submodular optimization. We show that a class of multi-resolution image summarization objectives can be formulated as multilinear extensions of non-negative submodular set functions and satisfy DR-submodularity with $m$-weak monotonicity. We then formulate...

论文介绍 可信 AI 要求可靠的数据处理流程，其中连续数据摘要作为上游组件易受对抗扰动影响。本文通过 DR-次模优化研究多目标对抗攻击，将多分辨率图像摘要目标形式化为非负次模集函数的多线性扩展，并证明其满足 DR-次模性和 m-弱单调性，为设计鲁棒防御方法提供了理论基础。

A Fast Gaussian Mechanism under Continual Observation, with Applications

第一作者: Rasmus Pagh · 方向: 安全研究

差分隐私持续观察高斯机制隐私保护向量发布隐藏英文摘要

Abstract:We consider the problem of privately releasing a $k$-dimensional vector under updates: Starting with a zero vector, at times $t_1, t_2,\dots$ the vector is updated by adding $x^{(1)}, x^{(2)},\dots$, respectively. For positive integers $T$, $k$ we model the updates as a data set $\{(t_i, x^{(i)})\}_i$, where $t_i \in [T]$ and $x^{(i)} \in B_k$ (the $k$-dimensional unit ball). Two such data sets are said to be neighboring if their symmetric difference has size at most $1$. The continual release consists of the sum $A^{(t)} = \sum_{i \; : \; t_i \leq t} x^{(i)}$ for each time step $t=1,\dots,T$. Classical continual release techniques allow us to release an approximation of $A^{(1)},\dots,A^{(T)}$ with additive noise of magnitude $\text{polylog}(T)$, computed in time $O(kT)$, even in the on-line, adaptive case where data is continually revealed for the current time step...

论文介绍 本文研究在持续更新下私密发布 k 维向量的问题，传统方法在在线自适应场景中计算开销较大。作者提出一种快速高斯机制，能够在时间步持续更新时释放向量和的近似值，噪声幅度为 polylog(T)，计算时间为 O(kT)，适用于实时数据流中的隐私保护应用。

Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attacks

第一作者: Omid Ahmadieh · 方向: AI 安全

人脸识别对抗攻击扩散模型文本引导隐私安全隐藏英文摘要

Abstract:The widespread adoption of face recognition (FR) technologies raises serious privacy concerns, as facial data can be exploited without consent. To address this challenge, we propose Adv-TGD, a generative adversarial attack framework that synthesizes photorealistic faces capable of impersonating target identities and deceiving face recognition systems. Built upon Stable Diffusion, Adv-TGD performs per-sample LoRA fine-tuning conditioned on concise textual prompts to generate natural yet adversarially manipulated identities. Unlike conventional identity-attack approaches, our method optimizes lightweight cross-attention adapters for each source-target pair within a single-step denoising process. Latent blending is constrained by a face-local heatmap mask to ensure spatially precise identity manipulation while preserving non-sensitive regions. We introduce a composite objective...

论文介绍 人脸识别技术的普及带来隐私泄露风险，易受冒充攻击。本文提出 Adv-TGD 对抗攻击框架，基于 Stable Diffusion 通过文本引导和 LoRA 微调生成逼真人脸，以冒充目标身份欺骗识别系统。该方法优化轻量级交叉注意力适配器，并使用面部局部热图掩码确保身份操纵的精确性，为评估系统安全性提供工具。

Superspace Concentration and Adversarial Robustness in Quantum Algorithms

第一作者: Eric Yocam · 方向: AI 安全

量子资源超空间集中对抗鲁棒性资源理论量子算法隐藏英文摘要

Abstract:We study superspace concentration as a quantum resource, formalized through the focus measure F(\r{ho}) = {\lambda}_max(\r{ho}_super) - the largest eigenvalue of the reduced superspace state - which quantifies the capacity of a quantum system to concentrate informational weight into a preferred subspace of an extended degree-of-freedom space. We develop a complete resource-theoretic framework around this measure and validate its properties through GPU-accelerated numerical simulation. Analytic decoherence predictions are confirmed to machine precision (1.11 x 10^{-16}) for superspace dimensions dS in {2,4,8,16,32}. Focus monotonicity holds across 10,000 random states with zero violations under four focus-non-generating channels across six system configurations. Focused quantum states resist coherent unitary attacks with significantly greater resilience than standard fidelity...

论文介绍 本文研究量子算法中的超空间集中作为量子资源，通过聚焦度量 F(ρ) 量化系统在扩展自由度空间中的信息集中能力。作者建立了完整的资源理论框架，并经 GPU 加速数值模拟验证，发现聚焦量子态在面对相干酉攻击时比标准保真度更具韧性，为提升量子算法的对抗鲁棒性提供了新视角。

On the Study of Biometric Spoofing Detection using Deep Learning

第一作者: Kumar Kartikey · 方向: AI 安全

生物识别欺骗检测深度学习人脸识别MobileNetV2隐藏英文摘要

Abstract:Biometric systems are increasingly deployed in security applications; however, they remain vulnerable to spoofing attacks, in which attackers exploit counterfeit biometric data to gain unauthorized access. This research evaluates the effectiveness of state-of-the-art machine learning models, MobileNetV2, DenseNet-121, Inception-v3, and Spoof Trace Disentanglement (STD) in detecting spoofing attacks within facial recognition systems. Using the CelebA-Spoof dataset, the study evaluates model effectiveness using metrics such as accuracy, precision, recall, and F1 Score. Cross-dataset validation is carried out on the MSU-MFSD dataset to assess generalizability. The results show MobileNetV2 as the most efficient model, achieving 92% accuracy while balancing computational effectiveness, making it appropriate for real-life applications. Inception-v3 shows moderate robustness, while...

论文介绍 生物识别系统在安全应用中易受欺骗攻击。本文评估 MobileNetV2、DenseNet-121、Inception-v3 等深度学习模型在人脸识别欺骗检测中的性能，基于 CelebA-Spoof 数据集进行训练，并在 MSU-MFSD 数据集上验证泛化能力。结果显示 MobileNetV2 以 92% 准确率和计算效率成为最佳选择，适用于实际应用场景。

Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models

第一作者: Malikeh Ehghaghi · 方向: AI 安全

语言模型对抗鲁棒性计算压力风险评估攻击成功率隐藏英文摘要

Abstract:Adversarial robustness evaluations of large language models (LLMs) typically report attack success rate (ASR) under fixed query budgets, implicitly treating all attacks as equally costly. In practice, the computational expense of different attack strategies can vary by orders of magnitude. Consequently, ASR at a fixed budget can obscure the true effort required to jailbreak a model, thereby making it hard to determine whether an attack's cost justifies its payoff to the attacker. We propose a compute-aware evaluation framework based on computational pressure, measured in cumulative floating-point operations (FLOPs), as a proxy for adversarial effort. We introduce risk-compute curves, which map compute budgets to attack risk, and derive two metrics that summarize the average pressure required for a given attack to succeed. Across ten models spanning three families and four...

论文介绍 大语言模型对抗鲁棒性评估通常基于固定查询预算，但忽略攻击策略的计算开销差异。本文提出计算感知评估框架，以累计浮点运算衡量计算压力，引入风险-计算曲线映射预算与攻击风险，并衍生两个度量指标。该方法能更真实地反映越狱模型所需努力，帮助判断攻击成本是否合理。

A prior-free blind detection of information leakage from model predictions

第一作者: Laurence A. Jacobs · 方向: 软件安全

信息泄露模型预测盲检测决策理论机器学习隐藏英文摘要

Abstract:Data leakage -- contamination of a model with information unavailable at baseline -- is the dominant reproducibility failure in machine-learning-based science, yet detection tools require training code, external data, or domain expertise. None operates on the artifact an auditor most often holds: the model's output. We ask what can be decided about leakage from predictions and outcomes alone. We give a decision-theoretic framework in which leakage diagnostics are functionals of the predicted-risk/outcome law, parameterized by a threshold-weighting linked to proper scoring rules and decision-curve analysis. We prove a sharp impossibility: a recalibrated leak matching an honest model's calibration and discrimination is indistinguishable from honest performance by \emph{any} function of the predictions, so the broad class is detectable only against an externally supplied ceiling...

论文介绍 数据泄露是机器学习科学中可重复性失败的主因，但现有检测工具需训练代码或外部数据。本文提出先验无关盲检测方法，仅基于模型预测和结果进行决策理论分析。作者证明，经过校准的泄露模型在预测函数上无法与诚实模型区分，但可通过外部上限进行检测，为基于输出的泄露诊断提供新途径。

PoQ-Judge: A Multi-Architecture Evaluation Framework for Cost-Aware Proof-of-Quality in Decentralized LLM Inference

第一作者: Arther Tian · 方向: AI 安全

去中心化LLM推理质量证明无参考评估法官模型多架构框架隐藏英文摘要

Abstract:Decentralized LLM inference networks need lightweight, reference-free quality evaluation for Proof of Quality (PoQ). We present PoQ-Judge, a framework that trains dedicated judge models to score query-output pairs without ground-truth references. We study three architectures across the quality-cost tradeoff: a TextCNN judge, a MiniLM cross-encoder, and a DeBERTa judge. Using two-stage training on UltraFeedback plus GPT-labeled in-domain data, the best model reaches 0.747 Pearson correlation with the ground-truth proxy on a held-out test set, outperforming reference-based evaluators from prior work. As a reference-free component in composite scoring, it achieves 0.645 Pearson correlation, matching the best single reference-based evaluator while removing the need for reference answers. We also show that online calibration identifies semantic quality as the dominant dimension and...

论文介绍 本研究针对去中心化LLM推理网络中的质量评估问题，提出PoQ-Judge框架。该框架通过训练专用法官模型（如TextCNN、MiniLM和DeBERTa）对查询-输出对进行评分，无需参考答案，以实现轻量级、无参考的质量证明评估。方法采用两阶段训练策略，结合UltraFeedback和GPT标记数据优化模型。该工作为成本感知的质量评估提供了可扩展的解决方案。

Hardware-Aware QAOA for Honeypot Traffic Partitioning on 100+ Qubit IBM Quantum Processors

第一作者: Cameron V. Cogburn · 方向: 系统安全

蜜罐流量分区量子近似优化算法加权MaxCut量子处理器拒绝服务缓解隐藏英文摘要

Abstract:Denial-of-service (DoS) and distributed denial-of-service (DDoS) mitigation requires separating malicious traffic from benign traffic while minimizing disruption to legitimate users. Prior work proposed mapping honeypot traffic partitioning to a weighted MaxCut problem and solving the resulting graphs with variational quantum algorithms. We extend this proof of principle direction with a reproducible event-level honeypot-to-QUBO pipeline, labeled temporal bipartite benchmark graphs with 16, 32, 66, and 110 event nodes, QAOA executions on IBM quantum hardware, classical heuristic baselines, a noiseless matrix product state reference, and a routing overhead analysis across quantum processor architectures. The largest benchmark is a 110-node, 181-edge instance executed on three IBM backends. Our results show that a shallow QAOA can execute real traffic partitioning workloads at...

论文介绍 本研究解决拒绝服务攻击缓解中的流量分区问题，将蜜罐流量分区映射到加权MaxCut问题，并使用量子近似优化算法（QAOA）在100+量子比特的IBM量子处理器上求解。提出可复现的事件级管道和时序二部图基准图，执行QAOA并与经典基线比较。该工作展示了浅层QAOA处理真实流量分区任务的能力，探索了量子计算在网络安全中的应用潜力。

Homomorphic Quantum Error Correction

第一作者: Kornikar Sen · 方向: 密码学协议

同态量子纠错量子同态加密稳定子码码空间保持密码学协议隐藏英文摘要

Abstract:Homomorphic quantum error correction aims to protect quantum data against both unauthorized access and environmental noise during server-based processing. We investigate the algebraic compatibility between quantum homomorphic encryption and quantum error correction, determining precise conditions under which encrypted encoded states remain inside the relevant code space during storage and computation. Our work establishes a necessary and sufficient criterion for an $[[n,1,d]]$ stabilizer code to remain compatible with the restricted transversal block-Pauli masking $U_{\rm enc}(a,b)=(X^aZ^b)^{\otimes n}$, stated explicitly for $[[n,1,d]]$ codes and extending directly to code-space preservation for $[[n,k,d]]$ codes. We verify this condition for standard examples (bit-flip and Shor codes, with the phase-flip repetition code following analogously), derive a practical criterion...

论文介绍 本研究探讨量子同态加密与量子纠错的代数兼容性，旨在保护服务器端量子计算中的数据免受未授权访问和环境噪声。通过分析加密编码态在存储和计算中保持在码空间内的条件，为特定稳定子码（如[[n,1,d]]码）建立了必要和充分准则。该工作为安全量子数据处理提供了理论基础。