2026-06-16

Hidden in Plain Sight: Benchmarking Agent Safety Against Decomposition Attacks with DECOMPBENCH

第一作者: Vikhyath Kothamasu · 方向: AI 安全

LLM代理安全分解攻击安全基准DeCompBench对抗滥用隐藏英文摘要

Abstract:LLM-based Agents are becoming increasingly capable and widely deployed, creating growing incentives for adversarial misuse in the real-world. A key emerging threat is Decomposition Attacks \cite{glukhov2024breach, jones2024adversaries} in which a harmful task is broken into simpler, benign subtasks that evade safety mechanisms when executed separately but cumulatively fulfill the malicious intent. Although recent benchmarks assess agent safety in multi-turn and multi-tool-use settings, they do not explicitly capture this form of decompositional misuse and may not represent realistic adversarial execution flows. To this end, we introduce DeCompBench, a benchmark designed specifically to evaluate agentic safety under decomposition attacks. DeCompBench is created with a decomposition-by-design principle using a graphical framework and enables harmful task decomposition into...

论文介绍 研究引入DeCompBench基准，专门评估LLM代理在分解攻击下的安全性，其中有害任务被拆分为良性子任务以规避安全机制。这为代理安全研究提供了新工具，促进防御策略开发。

Choric Masking in Ambient Release Systems: A Finite Certificate Calculus for Trace Indistinguishability under Bounded Audiences

第一作者: Faruk Alpay · 方向: 系统安全

06/12 07:17

环境释放系统合唱掩蔽迹不可区分性有限证书微积分安全验证隐藏英文摘要

This paper develops a finite certificate calculus for ambient release systems, staged probabilistic environments in which a protected coordinate is not observed directly but can remain statistically readable through visible roles, timing, repeated movement, bounded attention, linked rooms, and post-release state. The security notion, choric masking, requires the trace law induced by a protected locus to lie inside or near the convex hull of admissible cover traces under the tests available to a specified audience. For finite horizons, trace laws form polytopes, audiences induce measurement operators, and masking becomes intersection in the projected measurement space. Exposure is certified by separating hyperplanes, kernel obstructions, hypothesis-testing bounds, Fano-type localization lower bounds, and support separation in downstream rooms. The calculus distinguishes trace residue...

论文介绍 本文研究环境释放系统中的合唱掩蔽问题，旨在使敏感坐标在有限观众下保持统计不可读。核心方法是发展有限证书微积分，将迹定律视为多面体，通过测量算子投影，使用分离超平面等技术认证暴露。可能应用于隐私保护系统设计。

Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations

第一作者: Abhishek Reddypalle · 方向: 软件安全

软件供应链软件物料清单（SBOM）软件暗物质文件系统分析安全透明度隐藏英文摘要

Abstract:Modern software supply chains have evolved into vast, heterogeneous networks where transparency - the granular understanding of all software components - is now a critical security requirement. While Software Bills of Materials (SBOMs) have emerged as the primary mechanism for this transparency, current industry practices rely on a metadata-centric paradigm that assumes an artifact is defined solely by its package manager declarations. We posit that this assumption is fundamentally flawed, creating a systemic visibility gap we define as Software Dark Matter (SDM). SDM represents the set of security-critical files present in an artifact's filesystem that are unaccounted for by its associated metadata. We implement a reference tool, DARKFILES, and use it to analyze four ecosystems of disjoint nature: DockerHub, Maven Central, plugin/extension marketplaces (Jenkins plugins and...

论文介绍 本文指出当前软件物料清单（SBOM）实践依赖元数据，导致安全关键文件存在可见性缺口，定义为「软件暗物质」。通过实现DARKFILES工具分析生态系统，揭示未被记录的文件。意义在于提升软件供应链的透明度和安全。

Side-Channel Attacks Bypass Protection in 3D Printers

第一作者: Eric Yocam · 方向: 系统安全

侧信道攻击3D打印机主动电机噪声消除（AMNC）声学攻击振动泄露隐藏英文摘要

Abstract:Active Motor Noise Cancellation (AMNC) ships in commercial fused deposition modeling (FDM) 3D printers as a hardware countermeasure against acoustic side-channel attacks that target intellectual property (IP). We present the first empirical evaluation of a deployed AMNC countermeasure, using a public dataset of synchronized acoustic and vibration recordings from two AMNC-equipped Bambu Lab printers across 12 object classes. AMNC fully neutralizes the acoustic channel: classification accuracy is indistinguishable from the 8.33% random baseline. The vibration channel, which AMNC does not target, still leaks. With summary statistics the leak is coarse and amplitude-driven (vibration accuracy approximately 31% pooled, 36-47% within-printer), while the waveform shape carries essentially nothing (frequency-only features at chance). A full-sequence temporal model that ingests the...

论文介绍 本文首次实证评估商用3D打印机中的主动电机噪声消除（AMNC）防护效果，针对声学侧信道攻击。研究发现AMNC完全中和声学通道，但振动通道仍泄露信息，通过摘要统计可部分分类。揭示AMNC的局限性，强调振动侧信道的安全风险。

Crypto x AI, AI x Crypto: A Survey

第一作者: Sarah Allen · 方向: 区块链安全

人工智能区块链加密技术综述交叉研究隐藏英文摘要

Abstract:The intersection of crypto x AI is spawning papers, products, online posts, and companies. All the surrounding buzz, though, obscures what exactly has been done, what the opportunities and challenges are, and what open questions deserve attention. This survey paper asks what AI can do for blockchain-based technologies (broadly construed as "crypto") (crypto x AI), and vice versa (AI x crypto). We systematize existing work, summarize key takeaways, highlight open research questions, and offer a perspective on pervasive industry misconceptions, concluding that AI and crypto are still in the very early stages of meaningful integration.

论文介绍 本文综述人工智能与区块链技术的交叉领域，系统化现有研究，探讨AI如何赋能区块链及反向影响。总结关键点并指出两者仍处于早期整合阶段，澄清行业误解。为跨领域研究提供系统视角和开放问题。

RTL-Arrow: Hardware-to-Cloud Bridge

第一作者: Calvin Deutschbein · 方向: 软件安全

硬件安全RTL跟踪数据科学云就绪程序验证隐藏英文摘要

Abstract:Hardware Security at Willamette is a Willamette University affiliated research group studying the hardware-software interface of security critical services. Within our program, we noticed many researchers spent considerable development time learning to understand and manually parse traces-of-execution of hardware designs which are used to identifying whether vulnerabilities or weaknesses arise at the hardware, software, or interface level. We propose the "RTL-Arrow" framework, a framework to compile performant binaries which bridge the hardware/data divide. We translate the outputs of simulated hardware execution, as "value change dumps" into modern data science workflows as cloud-ready "dataframes", to standardize program verification across the hardware and software levels. We describe our approach, its benefits, and lessons learned from the process of packaging and...

论文介绍 本文针对硬件安全研究中手动解析执行跟踪耗时且易错的问题，提出RTL-Arrow框架。该框架将值变化转储（VCD）编译为云就绪数据帧，桥接硬件数据鸿沟，支持数据科学工作流。可能标准化硬件和软件级别的程序验证。

Information Flow Paths from RTL Traces

第一作者: Calvin Deutschbein · 方向: 软件安全

06/12 03:41

信息流跟踪RTL迹安全验证属性挖掘硬件设计隐藏英文摘要

Security validation is an important yet challenging part of the hardware design process, yet, by convention, validation engineers are tasked with defining the threat model, specifying the relevant security properties, detecting any violations of those properties, and assessing the consequences to system security, each of which is manually intensive and may introduce errors. The combined technologies of information flow tracking and specification mining represent an automated approach to property generation and validation, but prior work on information flow tracking on RTL trace data was limited to find cases under which information flowed between registers, without reproducing full paths to capture how sensitive information propagates through a design. With the introduction of new technologies accelerating hardware analysis, we develop a novel approach for constructing information flow...

论文介绍 本文开发新方法从RTL迹数据构建信息流路径，用于硬件安全验证的自动化属性生成和验证。结合信息流跟踪和规范挖掘，解决传统方法中属性手动定义易错的问题。可能提高硬件设计安全验证的准确性和效率。

Smart Blockchain-Based Access Control for the Internet of Things

第一作者: Mahdi Manavi · 方向: 网络安全

物联网访问控制区块链Hyperledger Fabric风险自适应隐藏英文摘要

Abstract:Securing access control in large-scale Internet of Things (IoT) deployments requires mechanisms that adapt to risk while preserving low latency for benign traffic. Permissioned blockchains such as Hyperledger Fabric offer auditability through smart contracts, but static endorsement policies impose the same validation depth on all requests, regardless of security posture. We propose a risk-adaptive enforcement layer for Hyperledger Fabric that couples an off-chain LSTM-based risk oracle with deterministic on-chain checks. The oracle assigns each request to a tier (Low, Moderate, High) and issues a signed attestation bound to the client identity and target key/version. Endorsing peers verify the attestation in chaincode and enforce tier-conditioned SBE policies without modifying the ordering service or consensus. Experiments on a Fabric testbed show that tier-conditioned...

论文介绍 本文为物联网提出基于区块链的风险自适应访问控制，利用Hyperledger Fabric和链下LSTM风险预言机。通过分层策略自适应安全需求，实验显示能平衡安全与性能。意义在于提升物联网访问控制的智能化和灵活性。

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

第一作者: Rui Melo · 方向: 软件安全

06/12 00:35

社会工程学代码审查大语言模型（LLM）安全基准漏洞利用隐藏英文摘要

Large language model (LLM) reviewers are increasingly used in pull-request (PR) workflows, where their approvals help decide which code is merged into a repository. This raises a question that benchmarks for static vulnerability detection or code generation do not address: can an automated reviewer reject a malicious contribution when the attacker controls both the code change and the accompanying PR text? We introduce SEVRA-BENCH (Social Engineering of Vulnerabilities in Review Agents), a benchmark that measures how often an automated reviewer approves such adversarial pull requests. Each malicious PR in SEVRA-BENCH is built from a real project commit that previously fixed a vulnerability listed in the Common Vulnerabilities and Exposures (CVE) database. We automatically invert that fix to restore the original vulnerable code and submit it as a pull request wrapped in one of 15...

论文介绍 本文针对大语言模型（LLM）在代码审查中的使用，提出SEVRA-BENCH基准来测量其批准恶意拉取请求的频率。基于CVE漏洞构建对抗性PR，评估自动化审查者的安全性。可能揭示LLM审查的漏洞并推动改进。

FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization

第一作者: Jianwei Wang · 方向: 安全研究

06/11 20:25

流式护栏未来感知推理安全对齐优化过度拒绝越狱攻击隐藏英文摘要

Stream guardrails enable token-level safety detection before full responses are generated. However, they often make overly conservative judgements and block those sensitive but safe tokens, which is known as over-refusal. Due to lack of full context, they also fail to detect implicitly harmful content from jailbreaking. To address these challenges, we propose FreoStream, a novel streaming guardrail framework. Specifically, FreoStream fine-tunes a LoRA module to perform Future-Aware Reasoning when the base guardrail detects unsafe tokens. The reasoning process follows a Future-Reason-Judge paradigm: predict the future, reason about the full context and give the final judgement. This design can effectively reduce over-refusal by incorporating the future information. Moreover, we introduce the Safety-Aligned Optimization module that extracts the safety-aligned component from the reasoning...

论文介绍 针对流式护栏在AI安全中因缺乏完整上下文而产生的过度拒绝和越狱攻击检测不足问题，本文提出FreoStream框架。核心方法包括利用LoRA模块进行未来感知推理，遵循未来-推理-判断范式预测未来上下文，并引入安全对齐优化模块。该设计旨在减少误报，提高token级安全检测的准确性和效率。

Security Threats and Their Impact on Blockchain Interoperability: Identification and Countermeasures

第一作者: Shawn M. Reynolds · 方向: 软件安全

区块链互操作性安全威胁分类攻击对策智能合约漏洞跨链安全隐藏英文摘要

Abstract:Blockchain interoperability enables independent blockchain systems to communicate and exchange assets across heterogeneous networks. However, the lack of comprehensive security mechanisms remains a critical weakness -- one that attackers have already exploited to cause hundreds of millions of dollars in asset losses. This paper presents a systematic identification and classification of security threats facing interoperable blockchain systems, along with corresponding countermeasures for each. We organize threats into five categories: (1) core blockchain attacks, (2) network attacks, (3) interoperability-specific attacks, (4) social engineering, and (5) code vulnerabilities, with particular attention to smart contract weaknesses. For each identified threat, we analyze its attack surface and propose effective defensive strategies. The resulting taxonomy provides a structured...

论文介绍 本文系统识别和分类区块链互操作性中的安全威胁，将其组织为核心区块链攻击、网络攻击、互操作性特定攻击、社会工程和代码漏洞五类。针对每类威胁分析攻击面并提出防御策略，为增强跨链系统的安全性提供结构化指导。

Evaluating LLMs for Obfuscation Detection and Classification in Android Apps

第一作者: Luca Ferrari · 方向: 软件安全

大型语言模型代码混淆检测Android安全语义推理实证研究隐藏英文摘要

Abstract:Android applications (apps) developers increasingly rely on code obfuscation techniques to hinder reverse engineering and protect intellectual property. However, obfuscation also reduces the effectiveness of static analysis and vulnerability detection tools, creating challenges for Android security analysis. Existing approaches for detecting obfuscation in Android apps predominantly rely on handcrafted heuristics, engineered features, or task-specific learning pipelines, which may struggle to generalize across evolving obfuscation strategies. This paper presents a large-scale empirical study investigating the capability of Large Language Models (LLMs) to detect obfuscation in Android apps through semantic reasoning. Our study evaluates whether off-the-shelf LLMs can identify obfuscated code without relying on handcrafted rules, predefined signatures, or dedicated model...

论文介绍 本文进行大规模实证研究，评估大型语言模型通过语义推理检测Android应用中代码混淆的能力。研究旨在解决现有方法依赖手工启发式规则的问题，探索LLMs在无预定义规则下的检测潜力，以提高安全分析工具的泛化性。

Investigating Metamorphic Fuzz Oracle Enhancement via Large Language Models

第一作者: Ruixiang Qian · 方向: 软件安全

06/12 14:43

模糊测试变异测试大型语言模型测试预言机增强自动化测试隐藏英文摘要

Fuzz drivers are essential components of greybox fuzzing, as they encapsulate target interfaces, define test spaces, and largely determine fuzzing effectiveness. Existing fuzz drivers typically rely on crash-based oracles for security testing, overlooking library functionality and limiting bug detection capability. In this paper, we present the first study on metamorphic-based fuzz oracle enhancement (MFOE), which augments existing fuzz drivers with metamorphic-based oracles derived from metamorphic relations (MRs). Since constructing and integrating such oracles requires substantial domain knowledge, automating MFOE is challenging. To address this challenge, we propose MetaFOE, an LLM-based framework that automatically generates and integrates metamorphic-based oracles. We evaluate MetaFOE on OSS-Fuzz drivers using three modern LLMs and five prompt strategies. MetaFOE generates 3,475...

论文介绍 本文提出MetaFOE框架，首次研究利用大型语言模型自动生成和集成变异测试预言机，以增强模糊驱动。该框架从变异关系中派生预言机，弥补传统基于崩溃的预言机的不足，旨在提高模糊测试的bug检测能力和自动化水平。

Bayesian-Calibrated Detection of Hallucinated Package Imports in AI-Assisted Code

第一作者: Lom M. Hillah · 方向: 软件安全

06/12 05:15

贝叶斯校准幻觉包导入检测LLM代码生成风险评估CI门禁隐藏英文摘要

We present a Bayesian calibration layer for slopsquat detectors -- those that flag hallucinated package imports in code produced by large language models (LLMs). Where existing pipelines emit binary decisions (flag / do-not-flag), our layer emits a Beta-posterior probability per detection, derived from a 3-category epistemic taxonomy that explicitly classifies each prior as empirically calibrated, constructively argued, or engineering-judgement-traced. Beyond the primary 200/404 registry channel, the calibrated layer exploits PyPI metadata signals -- package age, release count, author descriptor, summary -- to surface registered-but-suspicious packages that a binary registry detector misses, which is the realistic post-LLM-emission attacker regime. The resulting risk-aware primitive is directly consumable by downstream CI gates and supports principled threshold decisions across...

论文介绍 本文引入贝叶斯校准层，用于检测大型语言模型生成代码中的幻觉包导入。与二元决策不同，该方法提供概率风险评估，利用PyPI元数据信号识别可疑包，支持持续集成中的阈值决策，以增强代码安全性。

Safety-Contract Graph Multi-Agent Reinforcement Learning for Autonomous Network Security Response

第一作者: Jose Luis Lima de Jesus Silva · 方向: AI 安全

多智能体强化学习网络安全响应安全契约约束优化图注意力网络隐藏英文摘要

Abstract:Autonomous network-security response systems promise to reduce Security Operations Centre (SOC) reaction latency, but reward-only multi-agent reinforcement learning (MARL) can improve security reward while remaining non-deployable. We present a safety-contract graph MARL framework and instantiate it as ACD$^3$-GAT (Adaptive Constrained Counterfactual Decisioning with a Graph Attention Network encoder), an architecture that separates simulator observations from reusable operational budgets, constrained optimization, graph state encoding, and counterfactual action screening. We evaluate the method in CAGE Challenge 4, where agents operate under budgets for Mean Time to Recover (MTTR), false-positive response, and firewall change-management disruption. Across the benchmark, every unconstrained method violates the SOC downtime budget in 100% of evaluated episodes, with mean...

论文介绍 本文提出安全契约图多智能体强化学习框架ACD³-GAT，用于自主网络安全响应。该架构在约束优化下管理操作预算，如平均恢复时间和误报率，结合图状态编码和反事实动作筛选，以提高系统的可部署性和实际应用性。

A Modern Large-Scale Memory Characterization Laboratory

第一作者: Ataberk Olgun · 方向: 安全研究

内存表征DRAM实验室基础设施DRAM Bender内存瓶颈隐藏英文摘要

Abstract:Real memory chip characterization yields insights into fundamental operational characteristics of modern memory, enabling new mechanisms that improve memory performance, robustness, security, and energy efficiency. We describe our large-scale DRAM characterization laboratory for understanding DRAM. A key building block of this laboratory is DRAM Bender, a versatile and easy-to-use modern DRAM characterization infrastructure. We have updated DRAM Bender to i) introduce support for new types of characterization experiments, ii) expand on its DRAM interface standard support, and iii) make it easier to use at large scale. This paper introduces these updates for the first time. We hope our infrastructure enables the community to discover new problems and solve critical memory scaling issues, enabling the overcoming of the huge memory bottleneck that plagues modern computing systems.

论文介绍 本文介绍大规模DRAM表征实验室，更新DRAM Bender工具以支持新类型表征实验、扩展接口标准并提升易用性。该基础设施旨在促进内存研究，帮助社区发现新问题并解决内存瓶颈，以提升计算系统性能。