2026-06-22

FFinRED: An Expert-Guided Benchmark Generation and Evaluation Framework for Financial LLM Red-Teaming

第一作者: Chaeyun Kim · 方向: AI 安全

06/18 15:46

金融大语言模型红队测试安全评估风险分类基准框架隐藏英文摘要

Existing safety benchmarks target general adversarial scenarios but miss finance-specific risks. Financial LLMs face regulatory compliance violations, fraud facilitation, and systemic trust erosion that require targeted evaluation. We introduce FinRED, an expert-guided red-teaming framework for financial LLM safety evaluation developed with financial experts. FinRED uses a novel two-level taxonomy mapping global standards (e.g., FATF and EU DORA) to threats ranging from regulatory evasion to complex fraud, integrated with a scalable pipeline that converts real financial documents into context-rich red-teaming Behavioral Prompts (seeds) through an expert-defined schema. Rigorous expert validation confirms seed plausibility and realism for meaningful LLM safety evaluation. We also provide an expert-validated, finance-specific rubric that goes beyond disclaimer checks, aligns more closely...

论文介绍 现有安全基准未能覆盖金融领域特有的风险，如违反监管合规、助长欺诈及破坏系统性信任。本文与金融专家合作，提出了FinRED，一个专家引导的金融LLM红队测试框架。它构建了一个将全球标准映射到具体威胁的双层分类法，并设计了可扩展的流程，将真实金融文档转化为上下文丰富的测试种子，以评估LLM在复杂金融场景下的安全性。

Low-Cost Multi-Precision Systolic Arrays for Accelerating FHE NTTs on AI ASICs

第一作者: George Alexakis · 方向: 密码学协议

全同态加密数论变换脉动阵列硬件加速精度匹配隐藏英文摘要

Abstract:Fully Homomorphic Encryption (FHE) ensures robust data privacy but suffers from prohibitive computational overhead. Accelerating FHE on AI hardware like Tensor Processing Units (TPUs) is promising, yet fundamentally limited by a precision mismatch: TPUs are optimized for 8-bit arithmetic, whereas FHE and its critical parts such as the Number Theoretic Transform (NTT), demand high precision. Current approaches bridge this gap using matrix decomposition to execute NTT computations on low-precision matrix engines. However, reconstructing the full-precision results requires shift-and-add accumulation that does not match the dataflow of matrix multiplication. This forces offloading full-precision reconstruction from matrix engines to vector processors that disrupts the matrix multiplication dataflow, creating significant performance bottleneck. To resolve this limitation, we...

论文介绍 全同态加密（FHE）计算开销巨大，其关键操作数论变换（NTT）所需的高精度与AI硬件（如TPU）优化的低精度不匹配。现有矩阵分解方法在重构全精度结果时会破坏数据流，造成性能瓶颈。本文提出一种低成本的多精度脉动阵列架构，旨在直接在矩阵引擎内完成高精度NTT计算，以解决这一根本性限制，提升FHE在AI ASIC上的加速效率。

Heterogeneous LLM Debate Under Adversarial Peers: Honest Gains, Replacement Costs, and Resilience

第一作者: Prashanti Nilayam · 方向: AI 安全

大型语言模型异质辩论对抗鲁棒性推理基准防御机制隐藏英文摘要

Abstract:Heterogeneous LLM debate is motivated by the promise that diverse peers correct one another, but the same exchange that carries correction also carries adversarial influence. We measure which dominates by tracking how a heterogeneous peer changes the honest agents' revision behavior: how often they change their answer, and whether the change is corrective or harmful. We compare matched panels (homogeneous baseline, honest-mixed, and adversarial-mixed) and contaminated panels in which a malicious same-family peer is already present, spanning four model families and three reasoning benchmarks. An honest heterogeneous peer sharply lowers harmful revision, and an adversarial one reverses it. For Llama-3.1-70B defenders on MATH-hard, the honest-slot harmful-revision rate falls from 89% in the homogeneous panel to 35% with an honest peer, and an adversarial peer returns it to 90%...

论文介绍 异质大型语言模型（LLM）辩论中，多样化的同伴既可能纠正错误也可能施加对抗性影响。本文通过实证研究，测量了异质同伴如何改变诚实代理的修正行为，包括修正频率及其效果（纠错或有害）。研究对比了同质、诚实混合及对抗混合的面板，并跨越多个模型家族和推理基准。结果表明，诚实的异质同伴能显著降低有害修正，而对抗性同伴则会使有害修正率升高。

DISARM: Target Electronic Device Informed Mitigation of Software Runtime Side-Channel Vulnerabilities

第一作者: Tasneem Suha · 方向: 密码学协议

侧信道攻击时序泄漏软硬件协同嵌入式设备漏洞缓解隐藏英文摘要

Abstract:Program runtime or timing attacks exploit variations in a program's execution times to extract sensitive information from the program (e.g. encryption keys, sensitive variable data, intellectual property). State-of-the-art solutions to runtime side-channel attacks attempt to balance the execution time of the sensitive code for different control flow paths to eliminate the timing leakage. However, during the mitigation process, most techniques do not consider the underlying hardware or device on which the target program is supposed to run on. This can lead to over-fixing (unnecessary extra operations), under-fixing (not solving the imbalance properly), and even failures. We propose DISARM, a joint hardware-software methodology (unlike any existing solution) for mitigating runtime side-channel vulnerabilities that utilizes timing values from real embedded devices to generate...

论文介绍 程序运行时或时序攻击利用执行时间变化泄露敏感信息。现有缓解技术旨在平衡不同控制流路径的执行时间，但大多未考虑程序实际运行的底层硬件，可能导致过度修复、修复不足或失败。本文提出DISARM，一种利用真实嵌入式设备时序值的软硬件协同方法，以生成更精确的缓解方案，有效应对运行时侧信道漏洞。

SafeSpec: Fast and Safe LLM via Dynamic Reflective Sampling

第一作者: Haotian Xu · 方向: AI 安全

大语言模型推测推理安全防护反射采样延迟优化隐藏英文摘要

Abstract:Speculative inference accelerates large language model (LLM) decoding but provides no inherent safety guarantees. Existing safety defenses are largely incompatible with speculative inference: they either introduce additional computation or disrupt the draft-verify mechanism, negating acceleration benefits. This reveals a fundamental incompatibility between current safety methods and speculative decoding. We propose SafeSpec, a safety-aware speculative inference framework that integrates risk estimation directly into the verification process. SafeSpec attaches a lightweight latent safety head to the target model to jointly evaluate semantic validity and safety in a single forward pass. When unsafe generations are detected, SafeSpec applies rollback and safety-guided reflective multi-sampling to recover safe continuations rather than terminating generation. We model jailbreak...

论文介绍 推测推理能加速大语言模型（LLM）解码，但缺乏内生的安全性保证，且现有的安全防御措施大多与推测推理不兼容。本文提出SafeSpec，一个安全感知的推测推理框架。它通过在目标模型上附加一个轻量级安全头，在单次前向传播中联合评估语义有效性和安全性。当检测到不安全生成时，SafeSpec会执行回滚和安全引导的反射性多采样，以恢复安全延续而非终止生成。

When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems

第一作者: Prashant Kumar Pathak · 方向: 安全研究

06/18 09:40

向量检索hubness检索增强生成投毒防御全局门控隐藏英文摘要

Vector hubness, where a few points become nearest neighbors of many queries, creates a poisoning risk in retrieval-augmented generation (RAG): one injected document can influence unrelated requests. Existing defenses use periodic reverse-kNN scans, leaving an exposure window and repeated corpus-wide work. We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion. Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point (>=0.92 across the effective range) and 0.91 +/- 0.07 on HotFlip attacks, with 1% false positives on general documents. A per-topic gate provides no reliable benefit, consistent with anisotropy coupling local and global visibility. Thresholds are maintained incrementally, with...

论文介绍 向量检索中的「hubness」现象（少数点成为众多查询的近邻）为检索增强生成（RAG）带来投毒风险：一个注入的文档可能影响不相关的请求。现有防御依赖周期性反向kNN扫描，存在暴露窗口且计算量大。本文研究了准入时控制方法，在文档入库前利用哨兵查询进行评估并隔离类hub文档。实验表明，全局门控能在关键嵌入空间点实现高召回率，并有效防御HotFlip攻击。

A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots

第一作者: Gulshan Saleem · 方向: AI 安全

提示注入检索增强生成安全框架三层防御指令层级隐藏英文摘要

Abstract:Prompt injection is ranked as the most critical vulnerability in large language model (LLM) deployments by the OWASP Top 10 for LLM Applications, yet existing defenses operate at isolated pipeline stages and remain incomplete. Input filters cannot inspect retrieved documents, while output monitors cannot prevent malicious payloads from reaching the model. Consequently, retrieval-augmented generation (RAG) chatbots remain vulnerable to indirect injection, where a poisoned knowledge-base document compromises every user whose query retrieves it. We present a three-layer framework that intercepts both direct and indirect prompt injection throughout the inference pipeline. Layer 1 screens user input using a rule-based pattern library and a fine-tuned semantic anomaly classifier. Layer 2 enforces a provenance-based instruction hierarchy during context assembly, preventing retrieved...

论文介绍 提示注入是LLM部署中的关键漏洞，现有防御措施通常作用于管道的孤立阶段且不完整。例如，输入过滤器无法检查检索到的文档，输出监控器无法阻止恶意载荷到达模型。本文提出一个三层框架，以拦截整个推理管道中的直接和间接提示注入。该框架包含用户输入筛查、基于来源的指令层级强制执行以及输出检测，旨在为RAG聊天机器人提供全面保护。

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities

第一作者: Shangzhi Xu · 方向: 系统安全

ReDoS正则表达式拒绝服务漏洞检测攻击字符串生成隐藏英文摘要

Abstract:ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression (regex) engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and degrading service availability. To protect systems against ReDoS attacks, numerous detection techniques have been proposed that simulate the attack process by generating attack strings to proactively exploit ReDoS vulnerabilities at the early development stage and facilitate remediation. Existing techniques broadly fall into two classes: static analyses that search for pathological regex structures, and dynamic exploration methods that synthesize candidate attack strings. However, the generated attack strings are often impractical for real-world exploitation because they usually...

论文介绍 正则表达式拒绝服务（ReDoS）攻击利用正则引擎的病态最坏情况行为来耗尽系统资源。为在开发早期检测此类漏洞，需要生成用于主动探测的攻击字符串。现有技术生成的攻击字符串往往不切实际。本文提出PUFFERDOS，一种高效有效的攻击字符串生成方法，旨在生成更贴近真实利用场景的攻击字符串，以提升ReDoS漏洞检测的实用性和有效性。

G-Lox: Group-Adaptive, Privacy-Preserving Bridge Distribution with Two-Party Computation

第一作者: Baigang Chen · 方向: 系统安全

隐私保护桥接分配两方计算状态适应抗封锁隐藏英文摘要

Abstract:We present G-Lox (group-adaptive Lox), a bridge-distribution system that preserves Lox-style distributor blindness while enabling hidden, stateful group-level adaptation. G-Lox places adaptive assignment logic behind a two-server privacy wall, so no single server learns group identifiers or group-to-bridge assignments. Private state access and state-dependent updates use two-server DPF/FSS protocols and secure two-party computation, supporting blockage reporting, transport-aware reassignment, and privacy-preserving group splitting. We evaluate G-Lox through system measurements and policy simulation. In our C++/EMP implementation over real TCP sockets, private state access has low client-visible overhead: across state sizes up to 2^16, communication remains in the low-KiB range per iteration. At M=1024, the client sends 1,968 bytes, receives 1,280 bytes, and completes an...

论文介绍 现有桥接分配系统在实现自适应分配时可能损害分配器的隐私性（即不知晓用户与桥接的映射关系）。本文提出G-Lox，一种在保持分配器盲性的同时支持隐藏的、有状态的组级自适应分配的系统。G-Lox将自适应逻辑置于由两台服务器构成的隐私墙之后，通过两方计算协议进行私有状态访问和更新，从而在保护隐私的前提下支持封锁报告和传输感知的重分配。

FloatDoor: Platform-Triggered Backdoors in LLMs

第一作者: Nils Loose · 方向: 软件安全

大语言模型后门攻击平台触发浮点运算隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has shown that an identical model can produce measurably different outputs depending on the deployment platform, a consequence of non-associative floating-point arithmetic and divergent kernel implementations. We study the security implications of this platform-dependent variability and uncover a novel attack surface on LLM deployments. We introduce FloatDoor, the first input-independent, platform-triggered backdoor attack against generative LLMs. The compromised model exhibits adversary-chosen behavior when served on a target platform and is otherwise benign. FloatDoor is realized through two lightweight LoRA adapters, one that amplifies inter-platform numerical divergence and one that binds the...

论文介绍 该研究发现，大语言模型因不同硬件平台在浮点运算上的细微差异，会产生可测量的不同输出。作者据此提出首个输入无关、平台触发的后门攻击方法「FloatDoor」。该方法通过轻量级适配器放大平台间的数值分歧，并将特定行为绑定到目标平台，从而在模型被部署到特定平台时激活恶意行为，而在其他平台则表现正常。此工作揭示了LLM部署中一个由计算特性引发的新型安全风险。

Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix

第一作者: R.D.N. Shakya · 方向: 密码学协议

后量子密码学LLM辅助开发安全编码漂移游戏化学习隐藏英文摘要

Abstract:The transition to Post Quantum Cryptography (PQC) introduces considerable implementation complexity, requiring strict adherence to constant-time execution, side channel resistance, and precise parametrisation. Simultaneously, large language models (LLMs) are heavily embedded in software development workflows, including cryptographic engineering. While LLMs improve productivity, evidence shows that they frequently generate insecure or suboptimal code, particularly in security critical domains. This paper introduces Secure Coding Drift in PQC, a novel socio technical vulnerability model capturing the gradual degradation of secure coding practices due to sustained reliance on LLM-generated code. Unlike prior work that focuses on static vulnerabilities, we conceptualise security risk as a longitudinal behavioural phenomenon rising from human AI interaction. To mitigate this, we...

论文介绍 本文聚焦于向后量子密码学过渡过程中，因过度依赖大语言模型辅助编程而导致安全编码实践逐渐退化的现象，提出了「安全编码漂移」这一社会技术漏洞模型。该研究认为，LLM虽然提升效率，但在安全关键领域常生成非最优或不安全的代码。为应对这一长期行为风险，作者引入了一种游戏化的干预方案，旨在通过主动学习来抵消LLM引入的安全漂移，增强密码工程的健壮性。

bioETH-Beacon: A Confidential On-Chain Genomic Beacon with Encrypted Counts, Filters, and Bounded Noise over a Fully Homomorphic EVM

第一作者: Christos Galanopoulos · 方向: 密码学协议

06/18 22:49

基因组信标隐私保护全同态加密智能合约密码学协议隐藏英文摘要

The Global Alliance for Genomics and Health (GA4GH) Beacon protocol lets researchers ask whether a genomic variant has been observed in a participating cohort and receive aggregate variant-level counts. As Beacon networks grow, two privacy risks remain: host institutions can see plaintext queries, and repeated rare-variant queries can support membership-inference attacks. We present bioETH-Beacon, a smart-contract prototype that runs the Beacon "aggregate count" query over encrypted data on a fully homomorphic Ethereum Virtual Machine (fhEVM). Hospitals upload encrypted marker-count entries, authorized researchers submit encrypted marker queries, and the contract returns an encrypted answer that is released, via an off-chain key-management service, only to the requester named in the contract's on-chain ACL. The design is organized as a 3x4 tier-by-query-family grid spanning genotype...

论文介绍 针对基因组信标协议中医院可查看明文查询及罕见变体查询可能泄露参与者身份的隐私风险，本文提出了「bioETH-Beacon」原型系统。该系统在支持全同态加密的以太坊虚拟机上运行智能合约，实现对加密数据的聚合计数查询。医院上传加密的基因标记数据，研究人员提交加密查询，合约返回加密结果。通过链上访问控制列表，确保只有授权请求者能解密答案，从而在保护数据隐私的同时实现基因组数据的共享研究。

Artificial Intelligence as Game Changer in Cybersecurity: What We Learned in 2025-2026, and how this is relevant for Africa

第一作者: Mikael Alemu Gorsky · 方向: 软件安全

网络安全人工智能地缘政治非洲数字鸿沟隐藏英文摘要

Abstract:In 2025 and 2026, two events settled questions that had until then been speculative. In the first, a large language model executed the great majority of a state-aligned cyber-espionage campaign on its own, with human operators intervening at only a few decision points. In the second, the most capable cyber-relevant model was placed under a controlled-access program limited to a vetted set of United States technology firms, allied governments, and European standards bodies; that perimeter included no African government, operator, or university. Together the two events establish the argument of this paper: frontier language models have become a decisive instrument of cyber operations, and that instrument is built, owned, and rationed within a small circle from which Africa is absent. The paper documents Africa's exclusion on every count. The continent does not build frontier...

论文介绍 本文基于2025-2026年两个关键事件进行论述：一是大型语言模型主导了国家级网络间谍活动；二是最先进的网络能力模型被纳入由美国技术公司、盟国政府等组成的受限访问计划，而将非洲完全排除在外。文章据此论证，前沿语言模型已成为网络空间行动的决定性工具，但其构建、所有权和使用权集中于一个将非洲排除在外的封闭圈子。论文详细记录了非洲在技术构建、资源获取和标准制定等多方面的被边缘化状态。

Analyzing the Narration Gap in LLM-Solver Loops

第一作者: Zunchen Huang · 方向: AI 安全

06/18 04:44

形式化验证LLM求解器循环叙述差距安全关键系统隐藏英文摘要

Formal tools such as SAT and SMT solvers are increasingly embedded in language model reasoning pipelines when a safety or security critical question can be formulated in logic. Unlike chain of thought whose steps are sampled from the model distribution without formal guarantee, a solver produces a sound and independently verifiable answer. However, the soundness guarantee can be lost in the interaction between the solver and the model. The hybrid pipeline has three components: formalizing the question, deciding it, and narrating the result. Prior work has studied the formalization and decision, but not narration, which is the step that turns a formal tool's output into the user answer. To fill the narration gap, we first model the LLM-solver loop as a verified decision procedure. We further evaluate five open-sourced models under prompt injection, and we find certificate gating makes...

论文介绍 当安全或安全关键问题可被逻辑形式化时，形式化工具（如SAT/SMT求解器）正越来越多地被嵌入语言模型的推理流程中，以提供可验证的可靠答案。然而，在LLM与求解器交互的混合流程中，形式化保证可能在「叙述」步骤——即将求解器输出转化为用户答案的过程中——丢失。本文首次将LLM-求解器循环建模为一个经过验证的决策过程，并通过实验发现，采用「证书门控」机制能有效提升流程在提示注入攻击下的安全性，从而填补了该混合流程在叙述可靠性上的研究空白。

Passive-User Bell-State Loop-Back Key Establishment without Quantum Detectors at the User Nodes

第一作者: Luis Adrián Lizama-Pérez · 方向: 安全研究

量子密钥分发被动用户无探测器Bell态隐藏英文摘要

Abstract:We propose and analyze a Bell-state extension of the Loop-Back quantum key distribution architecture for secret-key establishment between two passive users that do not require quantum transmitters or quantum detectors. In the proposed setting, a single active station, Alice, provides the entangled-state infrastructure, retains one qubit of an initially prepared Bell pair, and sends the traveling subsystem through two passive users, denoted by $B_1$ and $B_2$. Each passive user applies a local Pauli operation to the same traveling subsystem, so that the operation observed by Alice is only the effective composition $U_{\mathrm{eff}}=U_2U_1$. After the subsystem returns, Alice performs a Bell-state measurement and, using her private knowledge of the initial Bell state, deterministically identifies the effective Pauli operation. However, the individual factors $U_1$ and $U_2$...

论文介绍 本文提出一种扩展的Bell态环回量子密钥分发架构，允许两个不拥有量子发射器或探测器的被动用户之间建立安全密钥。该方案中，一个主动站点（Alice）提供纠缠态基础设施，保留一对Bell态量子比特中的一个，并将另一个发送给两个被动用户。每个用户对行经的量子比特施加一个本地Pauli操作。当该子系统返回时，Alice通过Bell态测量和对初始Bell态的私有知识，可以确定性地识别出用户施加的有效复合操作，进而实现密钥协商。