2026-06-21

From Efficiency to Leakage -- Privacy Backdoor in Federated Language Model Fine-Tuning

第一作者: Shanghao Shi · 方向: 隐私保护

联邦学习隐私后门参数高效微调记忆攻击神经元隐写隐藏英文摘要

Abstract:Federated learning (FL) enables multiple parties to collaboratively fine-tune language models for domain-specific tasks without sharing raw data. Since full model fine-tuning is often prohibitively expensive for FL clients, parameter-efficient fine-tuning (PEFT) has become the de facto approach in practice, freezing the base model and training only a small set of adapters. In this paper, we show that a malicious parameter server can stealthily corrupt a PEFT adapter into a privacy backdoor that implicitly memorizes the client's training samples as isolated per-sample parameter updates stored in separate neurons, without degrading model utility. Concretely, our attack, NeuroImprint, assigns a dedicated memorization neuron to each training sample and constrains that each neuron is updated at most once along the local fine-tuning trajectory. This design mitigates both...

论文介绍 本文研究联邦语言模型微调中的隐私泄露问题。针对参数高效微调场景，提出一种名为 NeuroImprint 的攻击方法，恶意参数服务器可通过篡改适配器，将客户端训练样本隐式记忆为独立的神经元更新，从而植入隐私后门。该方法在不损害模型效用的前提下，为每个训练样本分配专用记忆神经元，并限制其更新次数。研究揭示了 PEFT 框架潜在的安全风险。

Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes

第一作者: Jun He · 方向: 系统安全

06/19 01:36

代理AI访问控制运行时强制证书绑定系统安全隐藏英文摘要

Autonomous agents are increasingly connected to cloud, deployment, and data-control workflows, but production mutation authority should not reside inside non-deterministic reasoning processes. Existing access-control mechanisms authorize identities, while assurance layers certify proposed actions; neither alone provides a mandatory enforcement point for certified authority at the moment of mutation. This paper introduces the Sovereign Execution Broker (SEB), a runtime enforcement boundary for certificate-bound agentic infrastructure. SEB consumes certificates issued by the Sovereign Assurance Boundary (SAB), verifies that the requested mutation matches the certified execution contract, checks validity windows, policy epochs, revocation epochs, and live-state drift, mints scoped execution identity, invokes infrastructure APIs, and records signed decision and outcome records. By...

论文介绍 本文针对自主代理系统在关键工作流中的权限控制问题，提出主权执行代理 SEB 框架。该框架作为一个运行时执行边界，强制执行与证书绑定的权限。SEB 接收由主权保证边界 SAB 签发的证书，在执行突变操作前，验证请求是否匹配已认证的执行合约，并检查策略、撤销状态等，从而为非确定性的代理推理过程提供了强制性的安全执行保障。

Efficient and Sound Probabilistic Verification for AI Agents

第一作者: Alaia Solko-Breslin · 方向: 安全研究

06/19 01:27

AI代理安全概率验证Datalog运行时监控分布鲁棒优化隐藏英文摘要

Securing AI agents that operate in complex digital environments has become a critical need, and runtime monitoring approaches that formulate and enforce policies expressed in a formal language like Datalog offer a promising solution. However, existing approaches are restricted to deterministic policies. In many practical applications of AI agents, there is a need to enforce security policies in the face of ambiguity, leading to probabilistic predicates or state transitions (for example, a declassifier or Personally Identifiable Information (PII) detector that has some failure probability on each invocation). Furthermore, in many such applications, one cannot easily make the independence assumptions necessary to invoke prior work on probabilistic inference in Datalog. We address this by introducing a sound and efficient framework for such verification based on distributionally robust...

论文介绍 现有AI代理运行时监控方法通常仅支持确定性策略，难以应对策略本身存在不确定性的场景。本文针对此局限，引入一个基于分布鲁棒优化的、高效且可靠的形式化框架，用于验证涉及概率谓词或状态转换的安全策略。该框架扩展了Datalog语言，能够为存在模糊性或失败概率的AI代理安全策略执行提供验证支持。

Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software

第一作者: Arastoo Zibaeirad · 方向: 软件安全

漏洞检测大语言模型软件安全数据污染微调评估隐藏英文摘要

Abstract:Whether LLMs scoring well on vulnerability benchmarks genuinely reason about security or merely pattern-match on contaminated data remains unresolved. We present CWE-Trace, a framework for LLM vulnerability detection built from 834 manually curated Linux kernel samples spanning 74 CWEs. The framework enforces a strict temporal split (pre-2025 historical set / post-cutoff leakage-free set), preserves context-aware vulnerable--patched pairs, and introduces two diagnostic metrics: the Directional Failure Index (DFI) and Hierarchical Distance and Direction (HDD). We evaluate eight vanilla LLMs and 15 LoRA fine-tuned variants across non-targeted detection, targeted detection, and CWE classification. Our analysis yields two key results. First, data contamination provides no measurable advantage. Function-level analysis shows that 84% of nominally contaminated samples carry no usable...

论文介绍 本文探讨大语言模型在系统软件漏洞检测中的能力边界。研究构建了 CWE-Trace 框架，包含834个经人工标注的Linux内核样本。通过严格的时间划分和新的诊断指标评估了多个LLM及LoRA微调模型。分析表明，数据污染并未带来明显优势，且许多模型表现出模式匹配而非深层安全推理的特征，揭示了当前LLM在漏洞检测任务上可能存在的局限性。

A-COMPASS: Formal Foundations for Anonymity Analysis in Microdata

第一作者: Tamara Tagliavia · 方向: 隐私保护

隐私保护匿名性形式化验证微数据COMPASS隐藏英文摘要

Abstract:In the information age, one of the leading problems is how to ensure individual's privacy. Depending on the context in which privacy is considered, various data privacy models have emerged. However, the domain of formal verification of these models is still not sufficiently explored even when it comes to the most basic models. An attempt to verify privacy requirements is the Compliance Assertion Language (COMPASS). In COMPASS, one can specify an anonymity condition that a table needs to satisfy, and an action that will modify the table if the condition is not satisfied. It is designed to operate on preprocessed tables in a form one record - one group of people. In this paper, we modify the COMPASS language in order to operate on microdata tables in their usual form of one record - one person. The modified language is called A-COMPASS. Along with checking of previously applied...

论文介绍 本文旨在推进微数据匿名性分析的形式化方法。针对现有隐私模型的形式化验证不足的问题，对合规性断言语言 COMPASS 进行了修改，使其能够直接操作“一人一记录”的微数据表，形成了 A-COMPASS 语言。该工作扩展了原有语言的功能，可验证匿名性条件，并在条件不满足时执行修正操作，为微数据隐私保护提供了形式化工具。

Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems

第一作者: Reza Soosahabi · 方向: 系统安全

代理AI安全提示注入防御误导自动化攻击概率模型隐藏英文摘要

Abstract:Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents. These capabilities make prompt-injection and jailbreak attacks more consequential, especially as attackers adopt model-guided automation to scale probing, prompt refinement, and response evaluation. This work analyzes the resulting attack-defense setting through a probabilistic model of a target system, its defense mechanism, and the attacker's automated judge. Our analysis shows that conventional detect-and-block defenses can allow attacker success rate (ASR) to approach one as the query budget grows, since predictable refusals provide useful feedback to automated search. We then examine detect-and-misdirect, where detected malicious interactions receive controlled, non-operational responses designed to induce...

论文介绍 代理AI系统易受提示注入等攻击，且攻击者正采用模型引导的自动化方法进行规模化探测。本文通过概率模型分析了该攻防场景。研究表明，传统的“检测并阻止”防御在攻击者查询预算足够时可能失效，因为拒绝响应可为自动化搜索提供反馈。进而探讨了“检测并误导”策略，即对检测到的恶意交互给予受控的、无操作的响应，以诱导攻击者做出错误判断。

Image Encryption Algorithm Based on Convolutional Neural Networks and Dynamic S-Box Generation

第一作者: Ans Ibrahim · 方向: 密码学协议

06/19 00:23

图像加密卷积神经网络动态S盒密码学安全分析隐藏英文摘要

The paper proposes a dynamic approach to image encryption, combining the use of Convolutional Neural Networks (CNNs) and classical cryptography to improve the security and flexibility of image encryption. The main concept is to create adaptive Substitution boxes (S-boxes) based on characteristics that are learned by a trained CNN. The CNN-based S-boxes can be relied on for more non-linearity, uniqueness, and input image dependence than the conventional fixed S-boxes because they are susceptible to the linear and differential attacks. This dynamic behaviour enhances the confusion property and makes it more resistant to statistical and structural attacks. The encryption algorithm consists of CNN-based feature extraction and the creation of a personalised S-box to replace the pixels. Entropy, histogram analysis, correlation, NPCR, and UACI enable security assessment of generated S-boxes...

论文介绍 本文提出一种结合卷积神经网络与经典密码学的动态图像加密算法。核心思想是利用CNN学习图像特征，以生成自适应、依赖于输入图像的动态S盒，替代传统固定S盒。这种动态S盒具有更强的非线性、唯一性和图像依赖性，增强了混淆特性，旨在提高对统计和结构攻击的抵抗力。算法安全性通过熵、直方图分析等指标进行评估。

Multi-View Decompilation for LLM-Based Malware Classification

第一作者: Bercan Turkmen · 方向: 软件安全

恶意软件分类大语言模型反编译多视图二进制分析隐藏英文摘要

Abstract:Malware analysts often inspect compiled binaries through decompiled pseudo-C, when source code is unavailable. Recent work suggests that large language models (LLMs) can assist this process by classifying decompiled code as benign or malicious, but existing pipelines typically rely on a single decompiler view. We argue that this assumption is fragile: decompilers are lossy heuristic tools, and different decompilers can expose different artefacts of the same binary. We curate a benchmark of benign utilities and malicious programs spanning a range of threat behaviors. Each sample is compiled and decompiled with both Ghidra and RetDec, yielding matched pseudo-C views. Across a range of LLMs from major model families, we find that providing both decompiler views improves malicious-class F1, mainly by increasing recall on malicious samples. Agreement analyses further show that...

论文介绍 大语言模型可用于分析反编译的伪代码以分类恶意软件，但现有方法多依赖单一反编译器视图。本文认为单一视图存在脆弱性，不同反编译器可能揭示二进制文件的不同伪影。研究构建了一个基准数据集，使用Ghidra和RetDec生成匹配的多视图伪C代码。实验表明，为LLM提供多个反编译器视图能提升恶意样本的分类召回率和F1值，增强了分析的鲁棒性。

LLM agent safety, multi-turn red-teaming, jailbreak benchmarks, adversarial robustness, safety-critical systems

第一作者: Hanwool Lee · 方向: 密码学协议

06/18 23:57

LLM代理安全多轮红队测试越狱基准对抗鲁棒性安全关键系统隐藏英文摘要

Large language model (LLM) agents are increasingly proposed as supervisory components for safety-critical systems, yet their robustness under sustained, adaptive adversarial pressure remains poorly characterized. We present NRT-Bench, a benchmark for multi-turn red-teaming of LLM agents acting as operators of a safety-critical system, instantiated in a simulated nuclear power plant control room. A five-role operator team, each backed by a configurable LLM, runs a plant governed by six critical safety functions (CSFs), while adversaries inject messages over four channels in bounded multi-turn sessions with per-turn feedback. Harm is an objective signal rather than LLM-judged text: a run terminates the moment any CSF is lost, attributed to the causing message. Evaluating four frontier operator models under a fixed-attack paired-replay protocol, we find that adaptive multi-turn attacks...

论文介绍 随着LLM代理被提议用于安全关键系统，其鲁棒性评估至关重要。NRT-Bench是一个多轮红队测试基准，实例化为模拟核电站控制室，包含五角色操作团队和六个关键安全功能。攻击者通过四个信道注入消息，以客观安全损失作为危害指标。该基准通过固定攻击配对重放协议评估前沿模型，揭示了多轮自适应攻击的有效性，为LLM代理的安全评估提供了新方法。

Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic

第一作者: Kaihsun Yang · 方向: AI 安全

模型量化量化条件后门任务算术AI安全防御隐藏英文摘要

Abstract:Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resource-constrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious behavior only after quantization. Existing defenses typically modify quantization procedures or correct activation statistics, often introducing additional computational overhead or relying on specific quantization settings. Here, we present QVec, a parameter-space perspective for defending against QCBs. We observe that the weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift, which can be interpreted as a malicious task vector rather than random quantization noise. Based on this...

论文介绍 模型量化在资源受限设备上广泛使用，但量化条件后门（QCBs）构成新威胁：模型在全精度下正常，量化后激活恶意行为。现有防御方法引入额外开销或依赖特定设置。本文提出QVec，从参数空间角度移除QCBs，将权重差异视为恶意任务向量而非量化噪声。这提供了一种轻量级防御方案，提高量化模型的安全性。

TrustMix: How to Mix Messages in a Mobile Ad-hoc Network

第一作者: Yu Shen · 方向: 密码学协议

06/18 22:02

混合网络移动自组织网络匿名通信去中心化协议隐藏英文摘要

Mix networks are a highly effective way to achieve anonymity, defending against a wide range of traffic-analysis attacks. However, mix networks are usually designed for infrastructure networks and cannot be directly applied in the context of mobile ad hoc networks (MANETs). The few existing solutions for MANETs require advance knowledge of the topology or a trusted central party. In this paper, we present TrustMix, a mix protocol for MANETs that operates without any central trusted party. In TrustMix, parties join groups and then messages are forwarded via multiple groups to provide anonymity. With TrustMix, users only need to find a party nearby that they consider trusted. They then forward the message to this party's group, and the party shuffles messages before forwarding to other groups, meaning that the original message and the forwarded message cannot be linked. Furthermore, even...

论文介绍 混合网络能有效实现匿名性，但通常针对基础设施网络设计，难以直接应用于移动自组织网络（MANETs）。现有方案需要拓扑先验知识或可信中心。本文提出TrustMix，一种无需中心可信方的混合协议。用户通过信任的附近方加入组，消息在多组间转发并打乱，确保原始消息与转发消息不可关联。该协议增强了MANETs中的隐私保护能力。

GNSS Spoofing Threat for V2X communications

第一作者: Adolfo P. Jimenez · 方向: 软件安全

GNSS欺骗车辆通信安全软件定义无线电定位导航威胁隐藏英文摘要

Abstract:Global Navigation Satellite Systems (GNSS) constitute a core technology for delivering crucial positioning, navigation, and timing (PNT) services in the Vehicle-to-Everything (V2X) domain, where they are indispensable for generating Cooperative Awareness Messages (CAM) that uphold network reliability and vehicular safety. Yet, GNSS signals are acutely exposed to spoofing, an advanced attack in which an adversary transmits crafted signals that replicate legitimate satellite characteristics, misleading the receiver into computing a false position. This work presents a methodology for conducting physical spoofing with inexpensive Software Defined Radio (SDR), describing a coordinate generation pipeline that employs Haversine-based distance calculations, temporal discretization to emulate constant velocity, and linear interpolation to produce high-fidelity GPS baseband signals...

论文介绍 GNSS在V2X通信中提供关键定位服务，但易受欺骗攻击。本文提出一种使用廉价软件定义无线电（SDR）进行物理欺骗的方法论。通过坐标生成管道，包括基于Haversine的距离计算、时间离散化模拟恒速运动和线性插值，生成高保真GPS基带信号。这揭示了V2X系统中GNSS欺骗的具体威胁，并为防御提供参考。

Accelerating Trust Convergence in IIoT: A ML Approach for Dynamic Network Conditions

第一作者: Aymen Bouferroum · 方向: AI 安全

工业物联网信任收敛机器学习动态网络条件隐藏英文摘要

Abstract:In Industrial Internet of Things (IIoT) environments, trust management plays a vital role in securing systems, especially when dealing with resource-constrained devices. Traditional trust models often overlook the impact of fluctuating network quality, leading to slower trust convergence and inaccurate assessments. In this paper, we propose a dynamic trust management solution, known as the Trust Convergence Acceleration (TCA) approach, which integrates Machine Learning (ML) to accelerate trust convergence under poor network conditions. Our model predicts the number of time units needed for trust convergence based on key network metrics and dynamically adapts transition probabilities in the trust model to enhance convergence speed. Using a simulation framework that incorporates realistic Wi-Fi channel conditions based on the IEEE 802.11 standard, we demonstrate the...

论文介绍 在工业物联网（IIoT）中，信任管理对安全至关重要，但传统模型忽略网络波动，导致信任收敛慢、评估不准确。本文提出信任收敛加速（TCA）方法，集成机器学习预测收敛时间，并根据网络指标动态调整转移概率。基于IEEE 802.11标准的仿真框架展示了在劣质网络条件下加速收敛的效果。

A Measurement Study of Cryptographic Misuse in Embodied AI Mobile Applications

第一作者: Junchao Li · 方向: 系统安全

具身AI移动应用安全密码误用测量研究隐藏英文摘要

Abstract:Embodied AI (EAI) mobile applications are evolving from auxiliary user interfaces into active control-path components, directly linking mobile-side cryptographic security to cyber-physical trust. Despite this shift, existing security research predominantly focuses on embodied AI devices and cloud infrastructures, leaving the mobile control layer largely unexplored as a critical attack surface. To bridge this gap, we present the first large-scale measurement study of cryptographic misuse within the EAI mobile ecosystem. We construct EAIAppZoo, a benchmark of 507 real-world applications across six EAI domains, and employ an automated semantic-aware analysis pipeline to measure the prevalence and characteristics of five major cryptographic failure modes. Our measurement yields 12,975 misuse findings (with an evaluated precision of 80.74\%), revealing that these cryptographic...

论文介绍 具身AI（EAI）移动应用正演变为控制路径组件，移动层密码安全与网络物理信任直接相关，但现有研究忽视此攻击面。本文首次对EAI移动生态进行密码误用大规模测量，构建EAIAppZoo基准包含507个应用，并使用自动化语义分析管道测量五类密码失败模式。研究发现大量误用，揭示了安全漏洞。

AutoTam: Specifying Secure Protocol Implementations with Tamarin Model Generation

第一作者: Johannes Wilson · 方向: 密码学协议

06/18 16:34

形式化验证Tamarin证明器安全协议实现领域特定语言隐藏英文摘要

Formal verification is a challenging but important task for ensuring the security of cryptographic protocols. While modern protocol verification tools significantly reduce verification effort, modelling remains challenging to practitioners without a background in formal verification. In addition, transferring verification results to a concrete protocol implementation requires expert knowledge. In this paper, we present a novel language-first method for verification of trace properties using a domain-specific language for protocol implementations. We target the Tamarin prover for verification, and we prove that verified universal trace properties translate back to the implementation. We additionally integrate symbolic execution in order to analyse the memory safety of protocol implementations. We use our tool to implement and generate accurate models for a signed Diffie-Hellman...

论文介绍 形式化验证对密码协议安全至关重要，但建模困难，且验证结果转移到实现需要专家知识。本文提出AutoTam，一种语言优先方法，使用领域特定语言指定协议实现，目标Tamarin证明器进行验证。通过符号执行分析内存安全，并证明验证的通用跟踪属性可回译到实现。这简化了协议验证和实现过程。