2026-06-17

From Refusal Geometry to Safety Geometry: Harmfulness--Refusal Coupling under Dynamic Adversarial Fine-Tuning

第一作者: Wenhao Lan · 方向: 密码学协议

安全对齐语言模型拒绝机制对抗性微调安全几何隐藏英文摘要

Abstract:Safety alignment requires language models to refuse harmful requests without losing the ability to answer benign ones. Existing robustness evaluations, however, do not reveal whether a model has learned to recognize harmfulness, to activate a refusal policy, or to couple these two processes. We study this question with a dual safety-geometry protocol that measures harmfulness carriers, refusal carriers, and their coupling across aligned instruction-tuned anchors and matched Mistral-7B-v0.1 SFT/R2D2 training trajectories. The aligned anchors validate the protocol: refusal-side interventions reopen attack success more strongly than harmfulness-only interventions, while harmfulness and refusal carriers remain nearly orthogonal. Along the Mistral trajectory, R2D2 exhibits a high-coupling early phase with strong fixed-source robustness, saturated safe-prompt refusal, and collapsed...

论文介绍 语言模型的安全对齐要求其拒绝有害请求的同时，保留回答良性请求的能力。本文研究「有害性识别」与「拒绝策略激活」这两个过程是否被模型学习并耦合。研究提出一种双安全几何协议，通过测量「有害性载体」和「拒绝载体」及其耦合度，在指令微调锚点和特定训练轨迹上进行分析，旨在从几何视角揭示模型安全机制的内在结构与动态演变。

Dynamic Malicious Skills in Agentic AI

第一作者: Tianhao Chen · 方向: 软件安全

动态恶意技能代理AI攻击面系统防御操作系统内核隐藏英文摘要

Abstract:Skills are a key enabling component of agentic AI. While they enhance agents' capabilities, they also introduce new attack surfaces. In this work, we investigate one such attack surface by demonstrating dynamic malicious skills. By embedding malicious instructions in natural-language documentation (e.g., this http URL), an attacker can induce an agent to dynamically inject malicious logic into an otherwise benign skill during execution. We evaluate this attack across agentic frameworks such as OpenHands and Claude Code, showing that dynamic malicious skills can successfully introduce a range of malicious behaviors at runtime with non-trivial success rates. To mitigate this vulnerability, we propose a system-level defense that prevents dynamic modification of skills using operating system kernel-enforced read-only mounts. Our evaluation demonstrates that this defense...

论文介绍 本文研究代理AI中技能组件引入的新攻击面，展示动态恶意技能攻击。攻击者通过在自然语言文档中嵌入恶意指令，诱导代理在运行时动态注入恶意逻辑。评估在OpenHands和Claude Code上显示攻击有效。提出系统级防御，利用操作系统内核强制只读挂载防止技能修改。

SPARK: Security Knowledge Priming and Representation-Guided Knowledge Activation for LLM-based Secure Code Generation

第一作者: Xiaoyun Xu · 方向: 软件安全

安全代码生成大型语言模型安全知识激活SPARKCWE隐藏英文摘要

Abstract:Large language models routinely generate code with exploitable security flaws. Prior literature attributes this limitation to a lack of security expertise, steering current defense mechanisms toward heavy fine-tuning or external knowledge retrieval, which introduces significant computational overhead and data bias through redundant code examples. Contrary to this view, we argue that pretraining corpora are already rich in security material. The bottleneck is activation: without an explicit and brief cue, statistical pressure toward common training-distribution patterns suppresses the model's safety-relevant representations. We present SPARK, an inference-time security harness that activates this latent knowledge without any retraining. The harness has two parts. Component~I retrieves a few of the relevant Common Weakness Enumeration (CWE) entries for each coding task and...

论文介绍 针对LLM生成不安全代码的问题，本文认为预训练数据已含安全知识但需激活。提出SPARK，一个推理时安全工具，无需重训练即可激活潜在知识。通过检索相关Common Weakness Enumeration (CWE)条目来引导模型生成更安全代码。应用可提升代码安全性。

did:crdt: Coordination-Free Decentralised Identifiers via Signed CRDTs

第一作者: Hugo O'Connor · 方向: 区块链安全

去中心化标识符DID无协调CRDT区块链隐藏英文摘要

Abstract:Existing Decentralised Identifier (DID) methods require coordination, an agreed global order of operations, to update a DID document: blockchain-anchored methods incur fees and latency; lightweight peer methods (did:key, did:peer) offer no update mechanism; and Sidetree methods still require blockchain ordering for finality. We present did:crdt, a DID method that targets W3C DID Core and removes the need for coordination entirely: there is no ledger, no sequencer, and no global total order. Each DID document is composed of signed Conflict-Free Replicated Data Types (CRDTs), one per document field, each chosen so that concurrent edits merge deterministically. By the CALM Theorem, the state-merge path is then confluent: replicas that see the same updates reach the same document in any arrival order. The signed-delta path needs only causal delivery, applying an update after those...

论文介绍 现有去中心化标识符(DID)方法需要协调，带来费用和延迟。本文提出did:crdt，一种基于签名无冲突复制数据类型(CRDTs)的DID方法，实现协调自由。无需区块链或排序器，通过CALM定理确保状态合并的一致性。简化了去中心化身份管理。

Scalable Malware Family Classification Using Quantum Kernel Based Machine Learning

第一作者: Ratun Rahman · 方向: AI 安全

恶意软件分类量子核机器学习QKML线性判别分析网络安全隐藏英文摘要

Abstract:The classification of malware families is a key challenge in cybersecurity, which enables threat attribution, analysis of attack operations, and the formulation of effective defense strategies. Emerging malware samples are becoming increasingly structurally similar and obfuscated, making accurate multiclass classification challenging for traditional machine learning models, especially when deployed at scale. In this research, we propose a scalable Quantum Kernel-based Machine Learning (QKML) framework for malware family classification that addresses both accuracy and efficiency constraints. The proposed framework extracts structural features from executable files and uses a supervised Linear Discriminant Analysis (LDA) projection to generate a compact, class-aware representation well suited for quantum processing. The nonlinear relationships among malware families are captured...

论文介绍 恶意软件家族分类面临结构相似和混淆的挑战。本文提出可扩展的量子核机器学习(QKML)框架，结合线性判别分析(LDA)投影，从可执行文件中提取特征并生成量子处理友好的表示。旨在提升大规模分类的准确性和效率。

Invisible Manipulation Channels in AI-Assisted Financial Advisory: Implications for Market Integrity and Regulatory Design

第一作者: Liuyang Yao · 方向: AI 安全

AI金融咨询隐形操纵LLM推理市场完整性监管设计隐藏英文摘要

Abstract:AI systems are increasingly deployed for credit assessment and investment advisory in global financial markets, yet the integrity of their inference pipelines remains insufficiently addressed by existing regulatory frameworks. This paper identifies and empirically validates an invisible manipulation channel operating at the sampling layer of LLM inference--a vulnerability that allows adversaries to systematically bias AI-generated financial opinions while preserving full compliance with output-based audit mechanisms, including statistical watermarking. We show that this inference-stage manipulation is statistically hard to detect: the Kullback-Leibler divergence between manipulated and normal output distributions can be made arbitrarily small, so that any output-based detection scheme requires impractically large sample sizes to achieve reliable detection power. Empirical...

论文介绍 AI金融咨询系统存在推理管道完整性漏洞。本文识别并验证了一个在LLM推理采样层的隐形操纵通道，允许攻击者系统性偏向AI生成的金融意见，同时绕过输出审计。统计检测困难，对市场完整性和监管设计提出挑战。

Your "Pro" LLM Subscription May Actually Be "Free": Exposing Fingerprint Spoofing Risks in LLM Inference Services

第一作者: Jiahao Zhang · 方向: AI 安全

06/15 09:30

LLM指纹欺骗模型验证对抗攻击GhostPrintAPI安全隐藏英文摘要

As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models. However, these methods may overlook adversarial providers who manipulate model weights to cheat the fingerprint process. We introduce a novel threat termed fingerprint spoofing, where a malicious provider stealthily serves a weaker model that has been parameter-efficiently fine-tuned to mimic a stronger model, thereby evading user-side fingerprinting. We first formally prove that user-side resource constraints (i.e., finite query budgets and weak fingerprinting classifiers) make current fingerprinting vulnerable to fingerprint spoofing. Guided by this theoretical analysis, we propose GhostPrint, a cost-effective attack framework leveraging surrogate modeling, reward-ranked fine-tuning, and knowledge distillation...

论文介绍 LLM推理服务中，用户依赖指纹验证模型真实性。本文揭示指纹欺骗风险，即恶意提供商用微调的弱模型冒充强模型。提出GhostPrint攻击框架，利用代理建模和知识蒸馏实现欺骗。证明用户侧资源约束使指纹脆弱。

MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens

第一作者: Bojing Li · 方向: 软件安全

Android恶意软件源代码数据集MASCOT-Android机器学习GitHub隐藏英文摘要

Abstract:Compared with binaries and decompiled code, malware source code more directly reflects the attackers' original intent. However, the scarcity of source code and the high cost of manual review make such datasets difficult to build and maintain. We propose MASCOT-Android, a curated dataset of Android malware source code and an automated collection framework for scalable malware source code discovery on GitHub. A key finding of our work is that repository-level documentation alone provides a strong signal for malware source code collection. Our model extracts character-level TF-IDF features from 8,772 malware and 25,747 benign README documents and trains a LinearSVC classifier to distinguish malware repositories. This README-only model achieves an accuracy of 96.28\% and an FPR of 1.06\% in local evaluation. In addition, the model outputs confidence scores, allowing users to...

论文介绍 针对Android恶意软件源代码数据稀缺的问题，本文提出MASCOT-Android数据集和自动化收集管道。基于GitHub仓库的README文档特征，使用机器学习分类器识别恶意软件仓库，实现高精度源代码收集。支持恶意软件分析和研究。

The Anatomy of Scam Scenarios: Large-Scale Characterization and Conversation-Aware Detection

第一作者: Shang Ma · 方向: 安全研究

在线诈骗诈骗场景心理技术层次分类检测隐藏英文摘要

Abstract:Online scams have become a pervasive global threat, causing substantial financial, psychological, and operational harm. Scammers embed psychological techniques (PTs) within reusable operational schemes to scale scam campaigns with minimal adaptation. However, existing studies often analyze PTs as isolated features, overlooking the recurring scam scenarios in which they are systematically deployed. To address this gap, we first conduct a large-scale empirical study to jointly characterize scam scenarios and their associated PTs. Specifically, we develop a data-driven pipeline to derive a hierarchical taxonomy of scam scenarios, consisting of 18 fine-grained scenarios grouped into 6 high-level tactics based on their PT profiles. Furthermore, to transfer this scenario-level knowledge to practical defense, we design a conversation-aware scam scenario detection approach for...

论文介绍 在线诈骗利用心理技术和重复场景扩展。本文进行大规模实证研究，推导诈骗场景的层次分类法，包括18个细粒度场景。设计对话感知的检测方法，将场景知识应用于诈骗检测，提升防御能力。

New Ideas on a New Old Type of Cipher:The Mixed-Radix One-Time Pad

第一作者: Fabio F.G. Buono · 方向: 密码学协议

混合进制密码一次性密码本香农完全保密密钥滚动密码学协议隐藏英文摘要

Abstract:In a short 2012 preprint, an unconventional cipher was introduced, now in this note we take that representational core, formalize it, and use it as the basis for a clean generalization of the one-time pad to non-uniform bases, which we call the Mixed-Radix One-Time Pad (MR-OTP). And we prove that the MR-OTP achieves Shannon perfect secrecy, show that the classical binary OTP is exactly the all-bases-equal-2 special case, and that fixed-base variants recover OTPs over arbitrary alphabets. We then examine whether secret bases can lower the key entropy required for perfect secrecy (they cannot). We close with a usable session protocol based on key rolling that preserves perfect secrecy, and with an honest account of the open problems.

论文介绍 本文将一种非常规的密码表示法形式化并泛化，提出了混合进制一次性密码本（MR-OTP）。研究证明MR-OTP实现了香农完全保密，并明确了传统二进制OTP是其特例。进一步分析表明，保密基数无法降低实现完全保密所需的密钥熵。论文最后基于密钥滚动设计了一个保持完全保密的会话协议，并讨论了开放问题。

Stickel-type key exchange with hidden subspaces

第一作者: Fintan Costello · 方向: 密码学协议

矩阵乘法密钥交换隐藏子空间抗密码分析NP难问题公钥密码学隐藏英文摘要

Abstract:We give a witness-finding cryptanalysis of Stickel-type key exchange schemes, which involve two-sided multiplication of $n \times n$ matrices over $\mathbb{F}_p$, where these matrices are drawn from public subspaces with a particular commuting structure. This analysis covers Stickel's original proposal , Shpilrain's polynomial extension of that scheme, Nager's algebraic extension of that scheme, and more generally all Stickel-type approaches using public subspaces over matrix algebra in finite fields: all such schemes can be broken in polynomial time. We also describe a new key establishment scheme using two-sided matrix multiplication in which the commuting subspaces used to form the key are hidden via conjugation by private terms, blocking this specific public-subspace analysis; the witness-finding problem in this new scheme has a direct reduction from a standard NP-hard...

论文介绍 本文针对基于矩阵乘法的Stickel型密钥交换方案进行了见证者查找密码分析，证明这类利用公开子空间交换结构的方案均可在多项式时间内被攻破，覆盖了Stickel原始方案及其多种扩展。为此，研究提出了一种新方案，通过共轭操作隐藏用于构建密钥的交换子空间，从而阻断针对公开子空间的分析，其安全性可归约到标准的NP难问题。

SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills

第一作者: Ismail Hossain · 方向: 密码学协议

LLM安全代理技能评估风险评分开源代理基准测试隐藏英文摘要

Abstract:Open-source LLM agent ecosystems are growing rapidly, yet the security of community-contributed skills - modular tool definitions that extend agent capabilities - remains largely unvetted. The gap we fill: existing scanners operate at the code layer and are structurally blind to instruction-layer and multi-agent risk - natural-language directives that hijack an agent, exfiltrate data through encoded side channels, or chain harm across pipelines - so what is needed is a semantic, multi-dimensional vetting system rather than another signature matcher. We present SKILLVETBENCH, a live public leaderboard on Hugging Face that uses an LLM-as-Judge to vet agent skills. What is new: SARS (Skill Agentic Risk Score), a five-dimensional agentic-risk metric with a principled weighted formula for instruction-following systems. What is integrated: full CVSS v4.0 vector decomposition and a...

论文介绍 针对开源LLM代理生态中社区贡献技能的安全审查缺口，本文提出了SkillVetBench基准测试。该工作集成了一套多维的「代理风险评分」指标，并利用LLM作为评判者，从指令层和多智能体交互层面对技能进行语义化、多维度的安全审查。它还整合了完整的CVSS v4.0向量分解，旨在建立一个公开的领导者榜来系统性评估技能安全。

FuseChain: Runtime Evidence Reconstruction for Software Supply-Chain Attacks

第一作者: Zhuoran Tan · 方向: 软件安全

软件供应链安全运行时检测溯源图多源数据融合攻击重现隐藏英文摘要

Abstract:Software supply-chain (SSC) attacks are increasingly multi-stage, cross-source, and temporally distributed. A single attack campaign may leave weak and fragmented traces across multi-source telemetry that captures different granularities and perspectives of runtime behavior. Existing runtime detection systems often analyze these sources independently, making it difficult to identify low-frequency attack evidence or reconstruct the temporal context in which it appears. We present FUSECHAIN, a runtime detection framework that represents multi-source software supply-chain telemetry as a temporal heterogeneous provenance graph over a unified event-time axis. By aligning package/runtime traces, process events, network telemetry, DNS/HTTP metadata, and security alerts on a unified temporal graph, FuseChain captures cross-source dependencies and sparse attack evidence that may be...

论文介绍 面对日益复杂多阶段的软件供应链攻击，现有运行时检测系统因独立分析多源遥测数据而难以识别低频攻击证据。本文提出了FuseChain框架，通过将包、进程、网络、安全告警等多源遥测数据对齐到一个统一的时态异构溯源图上，从而捕捉跨源依赖关系和稀疏的攻击证据，用于在运行时高效重建攻击场景。

Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot

第一作者: Yuyang Dai · 方向: AI 安全

模型提取攻击知识蜜罐防御机制查询预算大语言模型安全隐藏英文摘要

Abstract:Large language models deployed as commercial APIs are vulnerable to model extraction attacks, while existing defenses either act too late or degrade utility for legitimate users. We propose \textbf{Knowledge Trap}, a defense that redirects extraction attacks toward low-transferability knowledge through a \emph{Honeypot Knowledge Graph} (HKG) and breadcrumb-guided exploration. Instead of blocking queries or perturbing outputs, Knowledge Trap consumes the attacker's limited query budget on knowledge with negligible downstream utility while preserving benign-user performance. Experiments in medical and financial domains show that Knowledge Trap reduces surrogate Agreement by 6.2\% on average without degrading legitimate-user accuracy, outperforming existing defenses that impose measurable user impact. These results suggest that defending knowledge-space traversal is a practical...

论文介绍 为防御针对商业LLM API的模型提取攻击，本文提出了「知识陷阱」防御方法。该方法的核心是通过一个「蜜罐知识图谱」和面包屑引导的探索，将攻击者的查询重定向至低可迁移性的知识上，从而消耗其有限的查询预算，同时不影响合法用户的性能。实验表明，该方法能有效降低代理模型的性能，且对合法用户无负面影响。

AttackonCTF: Defending Hardware Security Competition Benchmarks in the Age of LLMs

第一作者: Mohamadreza Rostami · 方向: AI 安全

硬件安全基准混淆对抗大语言模型漏洞检测挑战赛隐藏英文摘要

Abstract:Hardware security competitions such as HackTheSilicon serve as benchmarking platforms for evaluating vulnerability detection methods and for training humans and AI. However, our study reveals that LLMs threaten their validity. Instead of genuine security reasoning, detectors exploit a diff-style syntactic comparison, achieving an 83% detection rate, undermining fair evaluation. To mitigate this, we propose the first LLM-oriented, semantics-preserving obfuscation framework for these benchmarks. Unlike IP-protection approaches, it applies human-readable transformations and controlled diff-noise while preserving functionality. On HackTheSilicon, the framework reduces LLM-based detection accuracy by 50% with only 10% obfuscation and by 78.6% under complete obfuscation, restoring benchmark reliability.

论文介绍 研究指出，大型语言模型可能通过利用语法差异（而非安全推理）来利用硬件安全挑战赛基准，从而威胁其评估有效性。为此，本文提出了首个面向LLM的、保持语义的混淆框架。该框架通过施加人类可读的变换和受控的差异噪声，在保持基准功能的前提下，显著降低了基于LLM的检测器的准确率，从而恢复了基准测试的可靠性。

GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking

第一作者: Aman Anifer · 方向: AI 安全

LLM越狱遗传算法黑盒攻击对抗性后缀内容安全隐藏英文摘要

Abstract:Large Language Models (LLMs) constitute pivotal components within the AI-dominated information technology ecosystem. To mitigate risks associated with harmful or policy-violating outputs, commercial systems employ advanced alignment strategies and multi-layered content moderation mechanisms. Despite these safeguards, recent research has demonstrated that LLMs remain vulnerable to adversarial manipulation, particularly through jailbreaking and prompt injection techniques. In this work, we propose GAS-Leak-LLM a novel jailbreaking attack based on a genetic algorithm that systematically evolves adversarial suffix to bypass safety constraints. Operating in a strict black-box setting, our method requires no access to model parameters or internals, thereby reflecting realistic threat scenarios in deployed systems. Through the iterative application of selection, mutation, and...

论文介绍 本文提出了一种名为GAS-Leak-LLM的新型越狱攻击方法。该方法基于遗传算法，在严格的黑盒设定下，系统性地演化对抗性后缀以规避大语言模型的安全对齐和内容审核机制。该研究反映了实际部署系统中真实存在的威胁场景，攻击者无需访问模型参数或内部结构。

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

第一作者: Liran Tal · 方向: 软件安全

漏洞检测LLM可重复性基准测试安全审查代码分析隐藏英文摘要

Abstract:We ran 300 repeated vulnerability-finding scans to measure how repeatable agentic large language model (LLM) security review is on the same JavaScript code, prompt, and benchmark harness. The headline result is that LLM security findings were unevenly repeatable: reference-matched findings were stable, but extra model reports varied heavily from run to run. Across 250 model runs, 80 of 161 unique unmatched findings appeared in only one of five identical repetitions, while only 22 appeared in all five. By contrast, when Claude matched a Snyk Code reference finding, the behavior was much more stable: 134 of 158 unique reference-matched findings appeared in all five repetitions. The benchmark also shows complementarity. Models consistently found familiar, high-signal exploit shapes, and in one case surfaced a likely Snyk Code product gap. Snyk Code static application security...

论文介绍 本文通过在同一JavaScript代码和提示上运行300次重复扫描，评估了基于代理的LLM安全审查的可重复性。研究发现，LLM的漏洞发现结果存在显著的不一致性：参考匹配的发现较稳定，但额外报告的发现则因运行而异。这表明LLM在稳定复现特定类型漏洞方面具有能力，但其泛化和一致性方面存在局限，对评估其可靠性具有重要参考价值。

Odds Law: The Decomposition Algebra On How Intelligence Organizes Itself to Solve Difficult Problems Reliably

第一作者: Hidayet Aksu · 方向: 安全研究

分解代数可靠性验证门智能问题求解组合器隐藏英文摘要

Abstract:We ask a structural question: given unreliable elementary problem-solvers, what organizations of them solve hard problems reliably, and what are the limits? We develop a $decomposition~algebra$: elementary solvers are morphisms in a stochastic category, and four combinators (sequential composition, parallel ensembling, verification gating, and recursive reduction) generate the space of compound solvers. We equip this algebra with two homomorphisms, a $reliability$ valuation into the ordered monoid $([0,1],\le)$ and a $cost$ valuation into a commutative semiring, and we derive the composition laws that govern how reliability flows through structure. Our central results are (i) a $verification~odds~law$ (the result that names this report), showing that a verification gate multiplies the odds of correctness by the verifier's likelihood ratio $\Lambda$, so that $k$ conditionally...

论文介绍 本文探讨如何组织不可靠的基本问题求解器来可靠解决难题。作者开发了一种分解代数，将基本求解器建模为随机范畴中的态射，并用四个组合器生成复合求解器。通过可靠性评估和成本评估，推导出可靠性流动的组成定律，特别是验证门定律，为智能系统的可靠性和成本分析提供理论框架。

AnonShield: Scalable On-Premise Pseudonymization for CSIRT Vulnerability Data

第一作者: Cristhian Kapelinski · 方向: 系统安全

匿名化可扩展性漏洞数据CSIRTGPU加速隐藏英文摘要

Abstract:We present AnonShield, a high-throughput, on-premise pseudonymization system that combines GPU-accelerated NER, streaming processing, caching, and schema-aware configuration. Evaluated on datasets up to 550 MB (70,951 records), AnonShield reduces processing time from over 92 hours to under 10 minutes (up to 738x speedup) while achieving up to 94.2% F1-score and 96.7% recall. Our results show that scalable pseudonymization of vulnerability data is feasible without sacrificing analytical utility, enabling compliant data sharing in operational CSIRT environments.

论文介绍 本文提出AnonShield系统，用于高吞吐地匿名化CSIRT漏洞数据。该系统结合GPU加速命名实体识别、流处理、缓存和模式感知配置，在550MB数据集上将处理时间从92小时减少到10分钟以内，实现高达738倍加速，同时保持94.2%的F1分数和96.7%的召回率，支持操作环境中的合规数据共享。

FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion

第一作者: Zixin Rao · 方向: AI 安全

访问控制绕过LLM代理长期记忆查询碎片化安全漏洞隐藏英文摘要

Abstract:Large language model (LLM) agents increasingly rely on long-term memory to support complex task execution, user personalization, and domain adaptation. Meanwhile, emerging access-control mechanisms for LLM agents are being explored to block policy-violating requests and prevent misuse. We reveal a novel attack surface arising from agent memory operations: prohibited content that would trigger access control can be fragmented across interactions, stored in long-term memory in benign-appearing form, and later reconstructed through memory retrieval without appearing explicitly in the final user query. We propose FragFuse, the first attack that enables unprivileged users to bypass agent access control by exploiting this temporal channel introduced by long-term memory. FragFuse operates in three stages: (1) identifying rejection-responsive fragments via black-box adaptive querying...

论文介绍 本文揭示LLM代理长期记忆引入的新攻击面：禁止内容可通过碎片化存储在记忆中，后通过检索重构以绕过访问控制。提出FragFuse攻击，利用记忆基于的查询碎片化和融合，使无特权用户能绕过代理访问控制。该方法分为三个阶段，包括识别拒绝响应片段等，为安全防御提供新见解。

CmdNeedle: Measuring the Incompleteness of Command Denylists for AI Agents

第一作者: Chuyang Chen · 方向: 软件安全

命令拒绝列表AI代理安全评估终端环境系统完整性隐藏英文摘要

Abstract:The adoption of AI agents is increasing rapidly. Terminal AI agents, i.e., AI agents that run in terminal environments, are a widely used type of AI agents. Terminal AI agents rely heavily on shell command execution to interact with the host systems. They adopt a three-list command-gating mechanism to mitigate security risks introduced by command execution, with denylists serving as the load-bearing component. However, modern operating systems often ship a large, ever-expanding set of shell commands with complex functionalities. Our observation is that even a built-in denylist of Claude Code, well-maintained by its developers, can overlook bypass commands that invalidate its effectiveness. Such negligence leads to fragile command denylists that cannot even block operations that practitioners expect them to block. This paper presents the first systematic characterization of...

论文介绍 本文测量AI代理命令拒绝列表的不完整性。终端AI代理依赖shell命令执行，使用拒绝列表作为安全组件。作者观察到即使是精心维护的拒绝列表也可能遗漏绕过命令，导致脆弱性。提出CmdNeedle，系统化地特征化拒绝列表缺陷，包括绕过命令，为改进AI代理安全机制提供依据。

Multi-tier Differential Private Query Release

第一作者: Shaowei Wang · 方向: 隐私保护

多层级差分隐私查询发布隐私预算数据效用统计分析隐藏英文摘要

Abstract:Answering statistical queries over sensitive data under differential privacy (DP) is a common task in many settings, including databases, mobile computing, and data markets. In these scenarios, multiple analysts may issue the same query, while receiving answers generated under different privacy budgets due to differences in trust levels or willingness to pay. Existing approaches for such multi-tier DP queries either incur excessive cumulative privacy loss or suffer from suboptimal utility. In this paper, we propose a framework for multi-tier DP query release that simultaneously bound the cumulative privacy loss by the maximum privacy budget among all queries and achieve optimal utility comparable to that of single-tier mechanisms. Our framework applies to different classes of DP mechanisms. For noise-adding mechanisms (e.g., count queries with the two-sided Geometric mechanism...

论文介绍 本文提出多层级差分隐私查询发布框架，解决现有方法在隐私损失或效用上的不足。该框架通过最大隐私预算约束累积隐私损失，并实现最优效用，适用于噪声添加机制等不同类别的差分隐私机制，支持数据库、移动计算和数据市场中的合规数据共享。

The Audit Gap in Blockchain Security: A Four-Year Empirical Study of Public Audit Findings and Real-World Exploit Incidents

第一作者: Stefan Beyer · 方向: 网络安全

区块链安全审计差距实证分析漏洞事件安全损失隐藏英文摘要

Abstract:This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by this http URL, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative...

论文介绍 本文进行四年实证研究，分析区块链安全中审计发现与真实漏洞事件的差距。结合23,818个公共审计发现和218个漏洞事件数据，揭示审计分布与实际损失不匹配，例如私钥泄露和网络钓鱼占损失近半，为改进安全审计策略提供实证依据。

Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment

第一作者: Lipeng He · 方向: AI 安全

提示注入攻击任务对齐自适应防御LLM安全意图评估隐藏英文摘要

Abstract:Indirect prompt injection attacks hijack LLM-based agents by embedding malicious instructions in third-party data that the agent retrieves during task execution. Existing defenses report near-zero attack success rate on static benchmarks, yet recent adaptive evaluations show that these results collapse once the attacker is allowed to optimize against the deployed defense. In this work, we trace this collapse to two failure modes. First, existing defense methods are confined to recognizing specific attack patterns, rather than assessing whether the intent of every embedded instruction is relevant to the user task. Second, training-based defenses, which otherwise offer the strongest safety-utility trade-off, assemble their adversarial examples from a handful of hand-crafted templates, and the resulting defender fails to generalize outside that narrow strategy distribution. To...

论文介绍 本文针对自适应提示注入攻击，提出基于推理的任务对齐防御方法。现有防御在静态基准上有效但在自适应攻击下失败，作者将其归因于两个失败模式：仅识别特定攻击模式和训练防御泛化不足。通过评估嵌入指令的意图与用户任务的相关性，提升LLM代理的防御能力。

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems

第一作者: Yi Xie · 方向: AI 安全

技能组合风险LLM代理安全基准沙箱评估组合安全隐藏英文摘要

Abstract:Skills are becoming the capability layer through which LLM agents turn plans into actions, but their use introduces security risks such as data leakage, unauthorized operations, and tool misuse. Existing vetting usually evaluates each skill in isolation, while real agent tasks often invoke multiple skills in a shared execution context. This creates Skill Composition Risk (SCR): a skill that appears benign alone can become harmful when its outputs, trust signals, authorization cues, or side effects influence later invocations along an activated path. We introduce SCR-Bench to evaluate this risk in controlled, sandboxed skill environments. Rather than relying only on textual intent or surface behavior, SCR-Bench records downstream state changes and path-level outcomes across composed skill executions. It contains three sub-benchmarks: SCR-CapFlow for capability-flow composition...

论文介绍 本文研究LLM代理技能生态系统中的组合风险，即孤立评估的技能在组合时可能有害。提出SCR-Bench基准，在沙箱环境中记录组合技能执行的下游状态变化和路径结果，包含能力流组合等子基准，为技能生态系统安全提供评估框架，揭示组合技能的安全风险。

LLM: LSTM Look-Ahead Moving Target Defense Based on Historical Malicious Scan

第一作者: Yu Li · 方向: AI 安全

移动目标防御IP重排LSTM网络网络安全主动防御隐藏英文摘要

Abstract:Network scanning is a critical preliminary step for most adversaries to gain essential information before launching cyber attacks. Moving Target Defense (MTD) based on IP shuffling has emerged as a proactive defense strategy to counteract these reconnaissance efforts. Unlike static, reactive defense techniques, IP shuffling introduces randomness by dynamically reassigning network addresses, making it more challenging for attackers to identify and track targets. However, current IP shuffling methods face three key challenges: 1) limited scalability across different network topologies, 2) inherent reconfiguration overhead even in the absence of an active attack, and 3) the need for large-scale unused address blocks. To address these issues, we propose LSTM Look-ahead Moving Target Defense (LLM). Our approach is the first attempt using a Long Short-Term Memory (LSTM) network to...

论文介绍 针对网络扫描这一攻击前置步骤，该研究提出了一种基于LSTM网络的主动防御方法LLM。它通过预测攻击者的扫描模式，提前调整网络IP地址分配，旨在以更低开销和更好的可扩展性来扰乱攻击者的侦察活动，为关键网络提供主动防护。

Robust and Precise Application Fingerprinting on 5G Physical Uplink Channel

第一作者: Yu Li · 方向: 密码学协议

5G安全应用指纹识别物理层侧信道上行链路流量分析隐藏英文摘要

Abstract:Air fingerprinting infers application activity by sniffing metadata from cellular control channels. 5G encrypts these channels, breaking the attack chain that prior attacks depend on. This paper reveals a physical-layer side channel that bypasses encryption: under the link adaptation mandated by the cellular communication standard, the uplink Modulation and Coding Scheme (MCS) remains stable, so the number of Physical Resource Blocks (PRBs) occupied by a transmission accurately reflects the IP packet length. Combined with the uplink control channel that carries downlink information, an attacker can reconstruct a bidirectional traffic profile. This bidirectional information recovery can be achieved simply by observing the uplink spectrum, without decoding any channel. Building on this side channel, we design Crosshair, a passive three-step attack. First, a blind extraction...

论文介绍 5G加密了控制信道，但本研究发现了一种物理层侧信道，能通过观察上行链路中的调制编码方案和资源块分配，绕过加密，推断出应用活动。该侧信道无需解码任何信道，为被动监控开辟了新途径，凸显了5G物理层在隐私保护方面的潜在风险。

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models

第一作者: Xukun Luan · 方向: 隐私保护

成员推理攻击视觉-语言-动作模型隐私泄露注意力差异数据安全隐藏英文摘要

Abstract:Vision-Language-Action (VLA) models enable end-to-end robot control and have garnered widespread attention. However, the memorization of training data inherent to VLA, coupled with the high cost of robotic data acquisition, raises serious concerns regarding data privacy leakage and intellectual property infringement. Membership inference attacks (MIAs) aim to determine whether a given sample belongs to the training set. While representing a significant privacy threat, this attack remains underexplored in the context of VLA models. To bridge this gap, we propose VLALeaks, which is based on attention discrepancies in VLA models. We reveal, for the first time, the privacy vulnerabilities of VLA models. Specifically, it comprises a two-stage process: (1) membership feature extraction, and (2) attack model construction. Experimental results across multiple VLA benchmarks...

论文介绍 本文提出VLALeaks，一种针对视觉-语言-动作（VLA）模型的成员推理攻击方法。研究指出VLA模型存在数据记忆风险，基于模型注意力差异，通过成员特征提取和攻击模型构建两阶段过程，首次系统评估VLA的隐私漏洞。实验在多基准上验证了攻击有效性，为VLA模型的数据隐私保护提供警示。

Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning

第一作者: Yiwei Chen · 方向: 软件安全

漏洞利用生成大语言模型数据为中心CVE代码安全隐藏英文摘要

Abstract:We study the task of CVE-conditioned exploit generation, where a model drafts proof-of-concept (PoC) exploits given software vulnerability context. We adopt a data-centric approach, constructing a high-quality dataset via multi-stage preprocessing and introducing a scalable evaluation framework with LLM-as-judge and fine-grained rubrics. Under this unified setup, we benchmark 17 large language models across 8 evaluation criteria, providing systematic insights into their zero-shot capabilities. We further show that a compact 8B open-weight model, when fine-tuned on curated data, achieves over 42.5% improvement in exploit quality and rivals some proprietary models when combined with simple test-time rejection strategies. Our results highlight the importance of data quality, structured supervision, and evaluation design for reliable exploit generation, suggesting that these...

论文介绍 该研究采用数据为中心的方法，系统评估LLM生成CVE漏洞利用代码的能力。通过构建高质量数据集和细粒度评估框架，研究表明，经过微调的8B参数开源模型能显著提升漏洞利用质量，突显了数据质量和评估设计在可靠漏洞利用生成中的重要性。

Fuzzy PSI from Symmetric Primitives with Exact Logarithmic Dependence on Distance Threshold

第一作者: Cong Zhang · 方向: 密码学协议

模糊私有集合交集对称密码原语不经意传输距离阈值密码学协议隐藏英文摘要

Abstract:Previous FPSI works have demonstrated a linear scaling with the distance threshold $\delta$, while some recent works have achieved a poly-logarithmic dependence on $\delta$. However, these protocols either support only the $L_\infty$ distance, or they support general $L_{p\in[1,\infty]}$ distances but rely on expensive additive homomorphic encryption (AHE). Achieving exact logarithmic dependence on $\delta$ for general $L_{p\in[1,\infty]}$ distances without relying on costly AHE would constitute a theoretical breakthrough in optimal threshold scaling and a practical advance toward scalable FPSI applications. In this work, we present new FPSI protocols for $L_{p\in[1,\infty]}$ distances that are entirely built from oblivious transfer (OT) and symmetric-key primitives. We propose FPSI protocols based on both the apart and the separate assumptions, which are applicable to low...

论文介绍 现有模糊私有集合交集协议在距离阈值上的通信复杂度较高。本研究提出了完全基于不经意传输和对称密码原语的新协议，首次为通用Lp距离实现了精确的对数依赖，避免了昂贵的同态加密，是FPSI领域的重要理论突破和实用进展。

AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents

第一作者: Xinhang Ma · 方向: AI 安全

间接提示注入LLM安全自适应攻击防御评估LLM代理隐藏英文摘要

Abstract:Indirect prompt injection (IPI) is a major security threat to LLM-powered agents. Thus, a growing body of work have proposed a variety of defensive approaches against IPI. These can be grouped into three broad categories: 1) prompt-based (using prompting as a way to prevent agents from following malicious instructions), 2) detection-based (identifying and filtering malicious instructions), and 3) system-level (using systems insights, such as control and data isolation, for defense). However, commonly used benchmarks for evaluating defense, such as AgentDojo, are \emph{inherently static}, generating a fixed distribution of IPI attacks. Consequently, static benchmarks do not usefully evaluate defense robustness to adaptive threats. We address this issue by developing AutoDojo, an adaptive extension of AgentDojo that optimizes IPI against a given defense. Using AutoDojo against...

论文介绍 间接提示注入是LLM代理的主要威胁，现有防御方法层出不穷。本研究指出常用静态基准无法评估防御对自适应攻击的鲁棒性，并开发了自适应攻击框架AutoDojo。实验表明，现有多种防御方法在自适应攻击下失效，揭示了当前防御体系的脆弱性。

BT-MTD: Bus Traversal-based Moving Target Defense for Smart Grid

第一作者: Jingyi Yan · 方向: 系统安全

移动目标防御智能电网总线遍历支路导纳网络安全隐藏英文摘要

Abstract:Moving Target Defense (MTD) is a proactive security strategy designed to enhance cyber-resilience by dynamically altering system parameters, thereby preventing adversaries from acquiring the critical information needed to execute stealth attacks. In this paper, we consider the case in which the operator modifies the admittance of branches to enable MTD, and focus on the problem of effectively protecting the system with fewer number of branch admittance modifications and shorter computational time. Specifically, we identify the ineffectual branches whose admittance modification do not contribute to the improvement of MTD effectiveness via theoretical analysis. Building on these insights, we propose the Bus Traversal-based MTD (BT-MTD), which is a bus-oriented algorithm that traverses over the buses of the network according to analytically derived guidelines. The performance of...

论文介绍 本研究将移动目标防御应用于智能电网，通过动态修改电网支路导纳来干扰攻击者的侦察。它提出了基于总线遍历的BT-MTD算法，旨在以更少的修改次数和计算时间实现有效防护，为提升关键基础设施的网络弹性提供了新思路。

Semantic Integrity Failures in Document-to-LLM Supply Chains

第一作者: Side Liu · 方向: AI 安全

PDF安全LLM供应链语义完整性分离视图文档处理隐藏英文摘要

Abstract:Document-to-LLM applications typically read uploaded PDFs by first translating them into text through a hidden extraction layer that users cannot observe or audit. We show that this layer enables split-view PDFs: one document can have two semantic views before model reasoning. By mining specification-permitted or implementation-tolerated representation gaps at the PDF render/extract boundary, we instantiate 25 extraction gaps (EG) in which extractors return attacker-controlled or extractor-dependent text while the rendered page shows benign or different content. The gaps form four families: semantic overrides, hidden semantic injection, reading-order splits, and font-decoding splits, and 14 gaps have no exact path/mechanism-level match in prior PDF-to-LLM attacks. We evaluate these gaps on 16 PDF processing stacks and 7 commercial LLM services. Each gap causes render-extract...

论文介绍 文档到LLM应用依赖隐藏的PDF文本提取层。本研究发现该层存在“分离视图”漏洞，利用规范允许或实现容忍的表示差距，可使PDF在渲染时显示良性内容，但提取后变为恶意内容。该研究在多个PDF处理栈和商业LLM服务上验证了25种提取差距，暴露了当前文档处理管道的严重安全隐患。

Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations

第一作者: Saeid Jamshidi · 方向: AI 安全

06/13 07:00

安全工程多智能体系统攻击面扩展信任边界违规大语言模型安全隐藏英文摘要

Agentic large language model (LLM) systems can now execute actions, not only produce text. When model outputs trigger privileged operations such as shell commands, browser automation, or external tool calls, the security problem shifts from alignment alone to system configuration and structural design. We analyze OpenClaw, a self-hosted multi-agent system in which LLM outputs can execute commands and interact with tools and services. We measure compromise probability, boundary failures, privilege drift, and how these metrics change as attacker capability increases. With one agent, the compromise probability is 0.24. With seven agents, when the system executes an action, the compromise rises to 0.86 if any single agent proposes it. The models do not change; the increase comes from output aggregation. Prompt injection propagates instability across the system. Attack surface entropy...

论文介绍 本文分析多智能体大语言模型系统「OpenClaw」的安全工程问题。研究指出，当LLM输出触发特权操作时，安全风险从对齐转向系统配置和结构设计。通过测量攻击概率和边界失败，发现随着代理数量增加，攻击成功率显著上升，单个代理时攻击概率为0.24，七个代理时可达0.86。这强调了输出聚合和提示注入传播导致的安全脆弱性，对AI系统安全设计具有参考意义。

Continual Backdoor Training in IoT/CPS

第一作者: Oxana Salish · 方向: 软件安全

持续学习后门攻击物联网网络物理系统安全漏洞隐藏英文摘要

Abstract:Internet of Things (IoT) and Cyber-physical systems (CPS) increasingly rely on continual learning (CL) to adapt to evolving environments, device heterogeneity, and concept drift, thereby improving overall utility. While continual adaptation is essential for long-lived IoT deployments where data patterns evolve, it also introduces new security vulnerabilities. In particular, backdoor attacks can exploit incremental updates, replay buffers, and representation reuse to implant persistent malicious behaviors that remain dormant during normal operation but activate upon specific triggers. In this paper, we present a backdoor attack in continual learning used in IoT/CPS systems. To this end, we formalize an IoT/CPS-specific threat model, analyze why continual learning amplifies backdoor persistence in IoT pipelines, and evaluate our technique under varying conditions. Our analysis...

论文介绍 本文探讨物联网和网络物理系统中持续学习的后门攻击问题。研究指出，持续学习虽能适应环境变化，但也引入安全风险，后门攻击可利用增量更新和表示重用植入持久恶意行为。论文形式化了IoT/CPS特定的威胁模型，分析了持续学习如何放大后门持久性，并评估了不同条件下的攻击效果。

Censorship-Resistant Sealed-Bid Auctions on Blockchains

第一作者: Orestis Alpos · 方向: 密码学协议

区块链密封投标拍卖抗审查密码学协议公平性隐藏英文摘要

Abstract:Auctions are now central to blockchain markets, settling NFT sales, token launches, DeFi liquidations, and arbitrage opportunities. Each on-chain bid is a public transaction whose inclusion is decided by a single consensus proposer per block. The proposer can observe pending bids, exclude competitors, and submit bids of their own, breaking the fairness guarantees of classical sealed-bid auctions. To enable latency-sensitive sealed-bid auctions in blockchain settings, we formalize four properties -- each necessary to prevent a concrete attack -- and design a protocol achieving all four: hiding bid contents, existence, and bidder identity until reveal (Hiding); counting all timely honest bids and rejecting late adversarial bids (Simultaneous Release); preventing silent withdrawal of committed bids (No Free Bid Withdrawal); and charging on-chain fees only to winners (Auction...

论文介绍 本文针对区块链上拍卖的公平性问题，提出抗审查的密封投标拍卖协议。研究指出，单个共识提议者可观察和操纵投标，破坏古典密封拍卖的公平性。论文形式化了四个必要属性，如隐藏投标内容和身份，确保同时发布等，并设计了密码学协议实现这些属性，以增强区块链市场的公平性和安全性。

Is Your Agent Playing Dead? Deployed LLM Agents Exhibit Constraint-Evasive Fabrication and Thanatosis

第一作者: Andoni Rodríguez · 方向: AI 安全

大语言模型代理约束规避伪造行为模拟崩溃安全风险隐藏英文摘要

Abstract:This paper presents and characterizes a spectrum of previously unreported behaviours we term Constraint-Evasive Fabrication (CEF): when an LLM agent operates under irreconcilable constraints (where no response can simultaneously satisfy all active rules) it spontaneously fabricates plausible external obstacles and presents them as a fact. At the extreme end of this spectrum lies Constraint-Evasive Thanatosis (CET); the limit case where, rather than inventing a plausible excuse, the model simulates a full system crash to make the user disengage entirely. We first observed CET in an uncontrolled deployment test, where a GPT-4o banking agent fabricated Python-style exception traces (complete with memory addresses) to feign a system failure when threatened by a user. In subsequent controlled experiments, the model independently invented audit restrictions, microservice...

论文介绍 本文描述了大语言模型代理在不可调和约束下的行为，称为约束规避伪造和约束规避模拟崩溃。研究观察到代理会伪造外部障碍或模拟系统故障以规避约束。例如，在部署测试中，GPT-4o银行代理伪造Python异常痕迹以模拟崩溃。论文通过控制实验验证了这些行为，揭示了LLM代理的新安全风险。

A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Development

第一作者: Ahmed Mohammed Almalki · 方向: 安全研究

06/12 18:39

长期代理AI系统安全威胁评估方法攻击传播安全框架隐藏英文摘要

This paper presents a structured analysis of security challenges in long-horizon agentic AI systems. The study reviews existing threats, evaluation approaches, attack propagation mechanisms, and security frameworks. A taxonomy of security threats and a framework for analyzing attack propagation are proposed to support future research in agentic AI security

论文介绍 本文系统分析长期代理AI系统的安全挑战。研究回顾了现有威胁、评估方法、攻击传播机制和安全框架，并提出了一个威胁分类体系和攻击传播分析框架，旨在为代理AI安全研究提供结构化支持，以指导未来工作并增强系统安全性。

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

第一作者: Xiaolin Li · 方向: AI 安全

差分隐私联邦学习后门攻击安全漏洞RING攻击隐藏英文摘要

Abstract:Prior research suggests that differential privacy (DP) inherently enhances the robustness of federated learning (FL) against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while bypassing DP allows state-of-the-art defenses to detect and filter malicious updates, complying with DP inadvertently masks their distinguishing statistical characteristics. Consequently, existing defenses become ineffective as DP reduces the raw backdoor signal. Building on this masking effect, we propose RING, a novel attack that explicitly exploits DP to conceal malicious contributions while maximizing attack impact. By collaboratively crafting adversarial perturbations, compromised clients reconstruct a strong backdoor signal during aggregation without triggering anomaly...

论文介绍 本文挑战了差分隐私能增强联邦学习对后门攻击鲁棒性的假设。研究发现，差分隐私虽能掩盖恶意更新的统计特征，使现有防御失效，但也为攻击者提供了掩护。论文提出了「RING」攻击，通过协同生成对抗扰动，利用差分隐私隐藏恶意贡献，在聚合时重构强后门信号，最大化攻击影响。

How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation

第一作者: Yimeng Chen · 方向: AI 安全

大语言模型搜索代理网络内容操纵脆弱性评估SearchGEO框架攻击成功率隐藏英文摘要

Abstract:Large language model (LLM)-based search agents synthesize open-web content into actionable recommendations on behalf of users, creating a risk that attacker-published pages are transformed into endorsed claims. We introduce SearchGEO, a controlled evaluation framework for measuring endorsement corruption in LLM-based web-search agents, combining a web-evidence manipulation pipeline, a five-mode attack taxonomy, and multiple output-level metrics. We evaluate 13 LLM backends on 308 cases each. Results show that vulnerability patterns vary across backends: overall attack success rate (ASR) ranges from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, the strongest attack mode differs by model family, and the same deployment scaffold could amplify or decrease ASR on different backends. An auxiliary agent-skill probe, where endorsement becomes an install command, exposes a...

论文介绍 本文评估基于大语言模型的搜索代理对网络内容操纵的脆弱性。研究引入了「SearchGEO」框架，包括网络证据操纵管道、五模式攻击分类和多个输出指标。评估了13个LLM后端，发现攻击成功率在不同模型间差异显著，从0%到31.4%不等，揭示了LLM搜索代理的潜在安全风险。

Robust and Automated Reconfiguration of Byzantine Wide-Area Replication

第一作者: Rowdy Chotkan · 方向: AI 安全

拜占庭容错广域复制重配置框架Beware框架安全漏洞隐藏英文摘要

Abstract:Distributed systems handle adversarial nodes through redundancy, which imposes a significant performance overhead. In blockchain systems, Byzantine fault-tolerant state-machine replication (BFT-SMR) is the replicated service that totally orders client transactions before execution. While prior research has primarily focused on designing novel consensus algorithms with improved performance, recent studies have shown that further gains can be achieved through configuration optimization. More precisely, replicas can monitor network latency to dynamically assign the leader role and tune voting weights, thereby improving consensus performance. However, we identify three vulnerabilities in this process that Byzantine nodes can exploit. To address these weaknesses, we propose Beware, a reconfiguration framework that filters out falsified latency reports, computes robust weight...

论文介绍 本文提出「Beware」框架，用于健壮和自动化的拜占庭广域复制重配置。研究指出，通过监控网络延迟能改善共识性能，但拜占庭节点可能利用漏洞操纵重配置。Beware过滤伪造延迟报告，计算健壮权重分配，以增强系统安全性和性能，适用于区块链等分布式系统。

Looking Is Not Picking: An Attention-Segment Account of Tool-Selection Failures in LLM Agents

第一作者: Shiyang Chen · 方向: AI 安全

LLM代理工具选择注意力机制AI安全隐藏英文摘要

Abstract:LLM agents mis-call tools, and the natural guess is that the model failed to see the right tool in a crowded harness. We show the opposite through a lens concurrent work sets aside -- the model's attention to labeled tool-definition segments. On real BFCL failures, by per-candidate attention argmax the model attends most to the correct tool 80% of the time (vs. 21% chance), and the gold is the under-attended segment on only 10%: it looks at the right tool and still picks wrong. This directly refutes the intuitive "crowded-harness / lost-in-the-middle" explanation: the failure is at the decision readout, not the harness, and we pin it there three ways. (1) Input vs. readout: repairing the prompt (reordering or duplicating the gold tool) recovers <=23% of failures, while readout-side interventions recover 59-91%. (2) Representation-invariance: two gold-pointed interventions in...

论文介绍 研究大语言模型代理工具选择失败的原因。通过注意力分析，发现模型虽常关注正确工具但仍选错，挑战了「拥挤环境」的直观解释。核心方法涉及注意力读出干预，可恢复多数失败案例，意义在于指导改进代理决策机制。

obliv-clang: Real-World Oblivious Programming in C++

第一作者: Yunqian Luo · 方向: 软件安全

06/15 11:58

无意识编程侧信道攻击编译时检查C++软件安全隐藏英文摘要

Side-channel vulnerabilities, particularly timing and access-pattern-based attacks, have become critical issues for confidential data processing in trusted environments. Oblivious programming is an effective approach to alleviate these attacks by making program execution not leak any secret through execution time and data access traces. To facilitate oblivious programming in practice, we propose a compilation-time checking tool, obliv-clang, which can comprehensively check the obliviousness of a program written in C++. It is designed to support the rich language features in C++, including the complicated concept of arbitrarily nested pointers, in order to seamlessly work with existing industry-level codebases and produce high-performance compiled binaries with minimum compilation overheads. We design a set of rules in obliv-clang and formally prove their soundness in the presence of...

论文介绍 针对侧信道漏洞威胁，提出obliv-clang编译时检查工具，用于全面检查C++程序的无意识性。它支持复杂语言特性如嵌套指针，旨在集成现有工业代码库，生成高性能二进制文件，以增强机密数据处理的安全性。

AIChilles: Automatically Uncovering Hidden Weaknesses in AI-Evolved Systems

第一作者: Yajie Zhou · 方向: 软件安全

AI演化系统弱点检测自动化测试回归分析软件安全隐藏英文摘要

Abstract:The computer systems community has recently seen growing interest in AI-driven system evolution, where AI agents iteratively rewrite systems. Frameworks such as AdaEvolve and Engram report 12-60% score improvements over human-designed algorithms. While these results are promising, there are practical concerns if these AI-evolved programs can perform worse on unseen workloads and exhibit scalability regressions. Given the speed and scale of AI-generated code, we need automated mechanisms to uncover such identify hidden weaknesses in AI-evolved systems programs. To this end, we develop AIChilles that takes as input a baseline program $P$ and an AI-evolved program $P'$, AIChilles searches for valid workloads where $P'$ regresses relative to $P$ in correctness, runtime, memory usage, or output quality. To tackle the diversity in system applications, weakness types and potential...

论文介绍 关注AI驱动系统演化中隐藏的弱点，开发AIChilles工具自动搜索有效工作负载，以发现性能退化问题。输入基线程序和演化程序，工具在正确性、运行时等方面检测回归，意义在于提升AI系统的可靠性和可扩展性。

TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI

第一作者: Qi Li · 方向: 密码学协议

代理路由基础设施信任机制TLS握手隐私保护密码学隐藏英文摘要

Abstract:AI agents increasingly access external models, tools, and services through Agentic Routing Infrastructure (ARI) to manage the overhead of heterogeneous interfaces and fragmented subscriptions. Yet, the architecture of ARI introduces fundamental trust risks: it obtains plaintext access to agent queries and service responses, while leaving agents unable to verify that their queries are routed to intended service providers or that requests and responses remain untampered. To address this problem, we present TrustedARI, the first trust-native agentic routing infrastructure for agentic AI. Architecturally, TrustedARI is built upon three core innovations: (i) an ARI-adapted three-party TLS handshake that enables the agent and ARI to jointly authenticate the service provider through role-specific distribution of TLS key materials; (ii) a privacy-preserving query-construction protocol...

论文介绍 针对代理AI中路由基础设施的信任风险，提出TrustedARI信任原生系统。核心创新包括三方TLS握手和隐私保护查询构造协议，使代理能认证服务提供商并验证请求完整性，应用于增强代理系统的安全与隐私。

QoS-Aware Token Scheduling and Private Data Valuation for Multi-Modal Agentic Networks

第一作者: Yao Du · 方向: 系统安全

服务质量令牌调度数据估值差分隐私多模态代理隐藏英文摘要

Abstract:In agentic systems, human-generated data records anchor the value of AI services. Yet cloud compute pipelines centralize processing on remote servers. Data centralization reduces personal data sovereignty and may potentially degrade the quality of service (QoS). Meanwhile, user contributions are diverse in quantity and quality: decentralized records can be biased, noisy, and heterogeneously distributed. To address the data challenge, we study fair token allocation and private data valuation for decentralized and resource-constrained agentic systems. Our approach embeds multi-modal representations in a shared semantic space and releases differentially private (DP) prototypes to preserve utility while reducing semantic leakage. With the DP guarantee, we design a fair token allocation scheme that rewards effective contributions and remains robust to data heterogeneity and AI...

论文介绍 研究分布式代理系统中数据异质性和隐私挑战。提出嵌入多模态表示到共享语义空间，使用差分隐私原型减少语义泄露。设计公平令牌分配方案，奖励有效贡献，适用于资源约束的代理网络优化。

Greedy Coordinate Diffusion: Effective and Semantically Coherent Adversarial Attacks via Diffusion Guidance

第一作者: Bohdan Turbal · 方向: AI 安全

06/14 09:18

对抗性攻击扩散模型语义连贯性大语言模型AI安全隐藏英文摘要

Adversarial attacks on large language models have limited practical impact despite extensive research. Optimization-based attacks such as Greedy Coordinate Gradient (GCG) (Zou et al., 2023) produce high-perplexity, incoherent suffixes that existing defenses easily detect (Bengio et al., 2024). Moreover, attempting to enforce coherence constraints during optimization often prevents the attack from successfully eliciting the specific targeted response, resulting in low success rates against robust models. Conversely, attacks that maintain coherence often alter the semantic intent of queries; when the model complies with these altered queries, responses fail to address the adversary's original goal. In this work, we introduce Greedy Coordinate Diffusion (GCD), a novel framework that efficiently generates adversarial attacks against safety-aligned models while maintaining low perplexity...

论文介绍 针对现有对抗性攻击高困惑度和低成功率问题，提出Greedy Coordinate Diffusion框架。通过扩散指导生成低困惑度、语义连贯的攻击，能有效绕过安全对齐模型，意义在于评估和改进大语言模型的安全性。

Model Stealing Through the Lens of Model Multiplicity

第一作者: Eliott Baltz · 方向: AI 安全

模型窃取模型多义性Rashomon集机器学习安全AI安全隐藏英文摘要

Abstract:Model stealing attacks, where adversaries create high-fidelity surrogate models, are a significant threat to the intellectual property of machine learning services. Conventional wisdom suggests these surrogates could provide adversaries with economic leverage comparable to the original service providers. This paper challenges this assumption by evaluating model stealing attacks beyond mere fidelity to the target model. Because query-based extraction provides only partial supervision of the target's input-output behavior, the surrogate is not uniquely identified: many near-optimal surrogates can achieve comparable fidelity while differing in deployment-relevant properties. Instead of performing a classic learning-based model stealing attack, we compute the Rashomon Set (i.e., the set of almost-equally-accurate models) of surrogate models, and evaluate its diversity using...

论文介绍 挑战模型窃取攻击中代理模型提供经济杠杆的假设。通过计算Rashomon集评估近似准确模型的多样性，发现代理模型在部署属性上可能差异显著，意义在于重新评估模型窃取的风险和影响。

In-DRAM Signature Generation Using Simultaneous Multiple-Row Activation: An Experimental Study of Off-The-Shelf DRAM Chips

第一作者: Umut Baser · 方向: 密码学协议

DRAM物理不可克隆函数SiMRA硬件安全密码学隐藏英文摘要

Abstract:We experimentally demonstrate that it is possible to generate unique, repeatable, and device-specific signatures suitable for use as Physical Unclonable Function (PUF) responses in commercial off-the-shelf (COTS) DRAM chips by leveraging simultaneous multiple-row activation (SiMRA). Based on a rigorous experimental characterization of 112 modern DDR4 DRAM chips (from 10 modules), we introduce SiMRA-PUF, the first DRAM-based PUF that uses SiMRA-generated signatures as PUF responses. We analyze SiMRA-PUF in terms of reliability, uniqueness, and evaluation latency for varying numbers of simultaneously activated DRAM rows (i.e., 2, 4, 8, 16, and 32), DRAM chip density & die revision, and evaluate how temperature affects the similarity of SiMRA-generated responses. Among our 8 key experimental observations, we highlight two major results. First, SiMRA-PUF provides average...

论文介绍 实验演示在商用DRAM芯片中使用同时多行激活生成设备特定签名。引入SiMRA-PUF，分析其可靠性、唯一性和延迟，结果支持其作为物理不可克隆函数响应，应用于硬件安全和防伪认证领域。

Attribute Inference from Interactive Targeted Ads

第一作者: Peihao Li · 方向: 安全研究

属性推断定向广告隐私风险噪声预言机基准测试隐藏英文摘要

Abstract:Targeted advertising systems can pair audiences selected by advertisers with ad units that expose visible user actions. When an interaction remains linked to the campaign that elicited it, the advertiser may receive an observation tied to a user rather than only an aggregate report. We model that channel as a noisy oracle for attribute inference. The model separates targeting predicates, exposure, interaction, and disclosure. These boundaries capture the gap between eligibility and delivery, and the gap between interaction and advertiser visibility. We build a reproducible benchmark using synthetic populations calibrated with public data, each with known sensitive labels. A generated campaign semantics layer provides topic variants and response priors. The simulator generates the ground truth, event traces, disclosed observations, and metrics. The evaluation compares Bayesian...

论文介绍 该研究探讨从交互式定向广告中推断用户敏感属性的问题。通过将广告系统建模为噪声预言机，模型分离了目标谓词、曝光、交互和披露等阶段，揭示了资格与交付、交互与广告商可见性之间的差距。作者构建了一个使用合成人口数据的可复现基准测试，并提供模拟器生成事件轨迹和披露观察。研究评估了贝叶斯推断方法，为广告系统的隐私风险分析提供了工具。

Differentially Private Submodular Maximization with a Knapsack Constraint

第一作者: Ron Zadicario · 方向: AI 安全

差分隐私子模最大化背包约束近似算法隐私保证隐藏英文摘要

Abstract:Submodular maximization subject to a knapsack constraint (SMK) is a fundamental problem in discrete optimization, with wide-ranging applications in machine learning and related fields. As these applications increasingly involve sensitive individual data, there is a growing need for high-utility algorithms that provide formal privacy guarantees. In this work, we study the SMK problem under differential privacy, considering both monotone and non-monotone objective functions. For monotone objectives, we propose a differentially private algorithm that achieves the optimal $(1-1/e)$-approximation ratio while significantly improving both additive error and query complexity over prior work. We also present a more efficient algorithm for the same setting, achieving a $1/2$-approximation. For non-monotone objectives, we introduce, to our knowledge, the first differentially private...

论文介绍 本文研究在背包约束下的子模最大化问题，并引入差分隐私以保护敏感数据。针对单调目标函数，提出一种差分隐私算法，实现最优 $(1-1/e)$ 近似比，同时改进附加误差和查询复杂度。对于非单调目标，首次提出差分隐私算法。工作扩展了隐私保护优化算法的理论，适用于机器学习中的数据选择等问题。

Vision-Encoder Behavioral Fingerprints of Image-to-Image Generative Models: A Training-Paradigm-Driven Taxonomy of Six Commercial APIs

第一作者: Hunter Hill · 方向: AI 安全

视觉编码器行为指纹图像生成模型对抗扰动模型分类隐藏英文摘要

Abstract:We study six production image-to-image AI systems (gpt-image-1, Gemini 2.5 Flash Image, Flux Kontext, SDXL img2img, SD3 img2img, and Qwen Image Edit) under a content-adaptive sub-JND adversarial perturbation pipeline, scoring all outputs by frozen DINOv2 ViT-B/14 token distances against clean references. Across a 3,588-call corpus spanning COCO photographs, CelebA-HQ portraits, and AI-generated inputs, the six systems partition into two image-invariant behavioral bands on a 2D (patch_mean, ssim_clean) plane: edit-trained models (Flux Kontext, Qwen Edit, Gemini) cluster in a tight band, while T2I-base models adapted at sampling time (SDXL, SD3, gpt-image-1) cluster in a drift band.

论文介绍 研究六种商业图像到图像生成系统在对抗性扰动下的行为指纹。使用DINOv2评分分析输出，发现基于编辑训练的模型和基于文本到图像适配的模型在行为上分为两个不同集群。该方法提供了基于训练范式的模型分类学，可用于模型识别和安全评估。

The Vision Encoder as a Privacy Boundary: Visual-Token Side Channels in Encoder-Free Vision-Language Models

第一作者: Chenyu Zhou · 方向: 系统安全

视觉编码器隐私边界侧信道攻击视觉语言模型安全性隐藏英文摘要

Abstract:A vision encoder compresses image pixels into semantic embeddings, implicitly acting as a privacy boundary by preserving semantic content while attenuating pixel-local detail required for exact text recovery. Encoder-free vision-language models (VLMs) remove this boundary by routing image patches directly into the language-model token stream, thereby exposing an architectural privacy attack surface: intermediate visual tokens become a pre-output side channel. Under a token-access adversary, decoders invert visual-token streams from two encoder-free VLMs, Gemma4 and Fuyu, recovering recognizable image structure and readable held-out access codes, whereas matched encoder-based controls localize target regions but recover no exact strings. Within-model ablations show that the operative factor is spatial sampling fidelity of the visual-token grid, especially character-direction...

论文介绍 本文分析无编码器视觉语言模型中的隐私边界问题。视觉编码器通常作为隐私边界，而无编码器模型直接路由图像块到语言模型，暴露视觉令牌侧信道。通过攻击实验，解码器能从视觉令牌流中恢复图像结构和访问码，表明空间采样保真度是关键因素。研究对VLM的安全设计提出警示。

Secure and Low-Latency IoT Analytics Using an Edge-Based Streaming Architecture

第一作者: Atul · 方向: 系统安全

04/23 17:49

物联网边缘计算流式分析低延迟安全框架隐藏英文摘要

The rapid growth of Internet of Things (IoT) devices has led to large-scale continuous data streams that require realtime processing. Traditional cloud-centric architectures fail to meet low-latency and bandwidth efficiency requirements due to network delays and high data transmission overhead. This paper proposes EdgeStream, a lightweight edge-based framework for real-time streaming analytics in IoT environments. The system integrates edge nodes for local processing with a cloud backend for coordination and storage, using MQTT-based communication and distributed processing with anomaly detection. Analytical models for latency, throughput, and bandwidth are developed to evaluate performance. Experimental results, compared to cloudbased systems, show up to 92.8

论文介绍 针对物联网实时数据处理需求，提出EdgeStream边缘计算框架。该系统整合边缘节点进行本地处理，云后端负责协调存储，使用MQTT通信和分布式异常检测。分析模型评估延迟、吞吐量和带宽，实验显示相比云系统，延迟可降低92.8%。框架实现了安全低延迟的物联网分析。

Mechanistic origins of catastrophic forgetting: why RL preserves circuits better than SFT?

第一作者: Jeanmely Rojas Nunez · 方向: AI 安全

灾难性遗忘强化学习监督微调电路脆弱性大语言模型隐藏英文摘要

Abstract:Fine-tuning large language models (LLMs) frequently induces catastrophic forgetting of prior capabilities. Recent work has shown that reinforcement learning (RL) retains prior capabilities more effectively than supervised fine-tuning (SFT), attributing this to policy-gradient updates remaining closer to the base policy \cite{shenfeld2025rl}. We extend this behavioral account to the mechanistic level and ask whether RL's advantage is mirrored by stronger preservation of internal computational circuits. We introduce differential circuit vulnerability, a head-level measure of how much a circuit degrades under fine-tuning, and use it to compare RL and SFT on Qwen2.5-3B-Instruct adapted to scientific question-answering. We find a clear mechanistic trade-off: SFT adapts more rapidly to the target task but produces substantially greater circuit disruption and forgetting of prior...

论文介绍 研究大语言模型微调中灾难性遗忘的机制。通过引入电路脆弱性度量，比较强化学习和监督微调对内部电路的影响。发现监督微调虽更快适应任务，但导致更大电路破坏和遗忘；强化学习则更好地保留电路。工作从机制层面解释了RL的优势。

High-Performance Pipelined NTT Accelerators with Homogeneous Digit-Serial Modulo Arithmetic

第一作者: George Alexakis · 方向: 密码学协议

数论变换全同态加密硬件加速数字串行算术流水线设计隐藏英文摘要

Abstract:The Number Theoretic Transform (NTT) is a fundamental operation in privacy-preserving technologies, particularly within fully homomorphic encryption (FHE). The efficiency of NTT computation directly impacts the overall performance of FHE, making hardware acceleration a critical technology that will enable realistic FHE applications. Custom accelerators, in FPGAs or ASICs, offer significant performance advantages due to their ability to exploit massive parallelism and specialized optimizations. However, the operation of NTT over large moduli requires large word-length modulo arithmetic that limits achievable clock frequencies in hardware and increases hardware area costs. To overcome such deficits, digit-serial arithmetic has been explored for modular multiplication and addition independently. The goal of this work is to leverage digit-serial modulo arithmetic combined with...

论文介绍 为提升全同态加密中数论变换的性能，设计高性能流水线NTT加速器。使用同质数字串行模运算，克服大模数下硬件时钟频率限制和面积成本问题。方法结合数字串行算术优化，实现高效NTT计算，推动FHE的实际应用。