2026-06-27

MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG

第一作者: Inderjeet Singh · 方向: AI 安全

检索增强生成红队测试蒙特卡洛树搜索多模态代理AI安全隐藏英文摘要

Abstract:Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning...

论文介绍 针对多模态代理检索增强生成系统攻击面扩大及现有红队方法易重复模板的问题，本文提出MIRROR跨表面红队框架。该方法在显式新颖性约束下执行记忆引导的蒙特卡洛树搜索，利用检索上下文调节候选生成，并通过确定性门控防止提示复制，有效提升了多模态RAG系统在复杂攻击面下的安全评估能力。

MergeLLL: A Hierarchical Divide-and-Conquer Framework for LLL-Based Lattice Reduction

第一作者: Niharika Gauraha · 方向: 密码学协议

格基约化分治策略密码学并行计算LLL算法隐藏英文摘要

Abstract:Lattice basis reduction algorithms have various applications in computational number theory and lattice-based cryptography, but their complexity increases rapidly with the dimension. Motivated by the divide-and-conquer strategy of merge sort and incorporating PotLLL-style deep insertions during recombination, MergeLLL is proposed. In this framework, a lattice basis is split into sub-bases, local reductions are performed independently, and the full basis is reconstructed through hierarchical merging. The approach is focused on improving local lattice structure first before global basis properties are refined, resulting in enhanced Gram-Schmidt orthogonality and numerical stability, while overall computational cost is reduced. The method is naturally parallelizable, allowing efficient multicore and distributed execution. It is shown that the reduction and merging steps preserve...

论文介绍 针对格基约化算法复杂度随维度快速增长的问题，本文提出基于分治策略的 MergeLLL 框架。该方法将格基分裂为子基进行独立局部约化，并结合深度插入策略进行分层合并。此方法优先改善局部格结构，提升了正交性与数值稳定性，降低了整体计算成本，且天然支持多核与分布式并行执行，适用于高维格密码分析。

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

第一作者: Christian Scano · 方向: 软件安全

06/25 15:37

安卓恶意软件对抗攻击问题空间机器学习软件安全隐藏英文摘要

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire benign modules, introducing many side-effect features and often causing build-time failures. Fine-grained methods that inject only a narrow subset of components exhibit limited effectiveness, while those that also use obfuscation rely on brittle bytecode rewriting, producing APKs that are syntactically valid but semantically unusable. Prior work further overestimates attack success rates by running smoke tests that only validate installation and basic execution, without assessing whether the modified APK still preserves its intended behavior. To overcome these limitations, we present DROIDBREAKER...

论文介绍 现有针对安卓恶意软件检测器的问题空间对抗攻击多存在构建失败或破坏应用原有功能等实用性问题。本文提出 DroidBreaker 框架，旨在生成既具备对抗性又保留完整功能的实用型对抗 APK。该方法克服了传统注入和字节码重写导致的语义失效缺陷，为评估和提升移动端恶意软件检测器的鲁棒性提供了有效的测试工具。

The Fungible Reserve Standard: A Deterministic Framework for Encoding Carrying Costs in Asset-Backed Tokens

第一作者: JJ Jia Jing Tan · 方向: 区块链安全

现实世界资产代币化区块链持有成本同质化代币隐藏英文摘要

Abstract:The tokenization of real-world assets (RWAs) has emerged as a transformative application of blockchain technology, with market projections estimating trillions of dollars in tokenized assets within the coming decade. However, a fundamental challenge remains unaddressed: physical assets such as precious metals, stored commodities, and warehoused goods incur structural negative carry -- custody, insurance, and audit costs that accumulate over time. While existing tokenization models have successfully established the market for digital gold and treasuries, they typically manage operational costs at the issuer level. The FRS introduces a framework to bring these economics directly on-chain, avoiding mechanisms such as token rebasing that compromise fungibility and composability with decentralized finance (DeFi) protocols. This paper proposes the Fungible Reserve Standard (FRS), a...

论文介绍 现实世界资产代币化面临物理资产存储与保险等持续持有成本的问题。本文提出同质化储备标准（FRS），将持有成本经济学直接引入链上。该确定性框架避免了代币重定基等破坏同质化与去中心化金融可组合性的机制，为贵金属和仓储商品等产生负收益的资产提供了标准化的链上成本编码与解决方案。

TGHE: Template-based Graph Homomorphic Encryption for Privacy-Preserving GNN Inference in Edge-Cloud Systems

第一作者: Ngoc Bao Anh Le · 方向: 密码学协议

同态加密图神经网络隐私计算边缘计算SIMD并行隐藏英文摘要

Abstract:Existing homomorphic encryption (HE)-based GNN systems adopt a graph-centric paradigm that couples per-query cost to global graph size, limiting evaluations to at most ~20k nodes and making them incompatible with dynamic, large-scale financial graphs. We propose TGHE (Template-based Graph Homomorphic Encryption), an ego-centric framework that resolves this by exploiting a template phenomenon: local computation trees in transaction graphs converge into a small set of structural shapes. TGHE canonicalizes ego-graphs at the edge and packs structurally identical trees into shared CKKS ciphertexts for SIMD-parallel encrypted inference, with two long-tail optimizers (Approximate Template Fitting and Topology Collapse) ensuring full SIMD coverage. On DGraphFin (3.7M nodes, 4.3M edges), TGHE-Collapse achieves a 66.9x speedup over the sequential encrypted baseline with less than 0.002...

论文介绍 针对现有同态加密图神经网络系统受限于全局图规模的问题，本文提出基于模板的图同态加密框架 TGHE。该方法利用交易图局部计算树的结构收敛特性，在边缘端将同构子图打包至共享密文中，实现单指令多数据流并行加密推理。TGHE 大幅提升了大规模动态金融图的隐私推理效率，适用于边缘云协同系统。

Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents

第一作者: Nada Lahjouji · 方向: AI 安全

大语言模型智能体数据隐私信息安全综述隐藏英文摘要

Abstract:Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf. As they move from answering questions to operating over sensitive data, privacy becomes harder to enforce. An agent touches many data sources, runs multi-step workflows, keeps state across sessions, and acts with delegated permissions. Sensitive information can therefore leak not only through its final answer but through the queries it issues, the intermediate results it handles, the memory it writes, and the messages it exchanges with other agents. We survey the privacy of LLM agents from a data-centric view, organizing the field around the data an agent touches rather than by attack type, and we use data agent as shorthand for an LLM agent that works with data. Research on these risks is active but scattered across...

论文介绍 随着大语言模型智能体日益深入地操作敏感数据，其多步工作流与跨会话记忆引发了复杂的隐私泄露风险。本文从数据中心视角对智能体隐私进行综述，围绕智能体接触的数据源、中间状态与交互消息来组织研究。该工作系统梳理了数据流转中的隐私威胁，为构建安全可控的数据智能体提供了理论参考与防范思路。

Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models

第一作者: Abrar Alotaibi · 方向: AI 安全

扩散模型对抗攻击多模态大语言模型综述隐藏英文摘要

Abstract:Adversarial evaluation of AI systems has matured along four largely disconnected tracks: diffusion-based attacks on text and large language models (LLMs), diffusion-based attacks on image classifiers, jailbreak pipelines against vision-language models, and diffusion-based input purification defenses. Each has developed its own vocabulary, threat models, and benchmarks, with denoising diffusion models emerging as a shared generative mechanism whose recipes are now actively ported between communities. This survey performs an information-fusion exercise at the meta-research level: we integrate these four tracks into a single conceptual framework with a unified taxonomy, evaluation criteria, and research agenda, focusing on the LLM-side slice. We catalog fifty published papers across four scope areas (text/LLM, image classifier, vision-language model, defense), plus four...

论文介绍 针对人工智能对抗评估中各模态研究相互孤立的问题，本文对基于扩散模型的跨模态攻击、防御与评估进行融合综述。研究将文本、图像及视觉语言模型等独立轨道整合为统一的概念框架与分类体系，重点聚焦大语言模型侧的扩散机制。该工作梳理了现有基准与威胁模型，为多模态大模型的鲁棒性研究提供了系统指导。

TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA

第一作者: Subin Song · 方向: 密码学协议

5G网络广播认证伪基站防御密码学协议TESLA隐藏英文摘要

Abstract:5G base stations broadcast unauthenticated system information (SI) that every user equipment (UE) reads during cell selection. This enables attackers to broadcast forged SI from a fake base station (FBS), deceiving UEs into camping on it. Prior approaches require UEs to authenticate System Information Block 1 (SIB1) using digital signatures. This necessitates computation-heavy verification for every SIB1 reception, imposing a significant burden on resource-constrained UEs. We propose TESLA-for-5G (TF5), a broadcast authentication protocol for 5G SIB1 that combines TESLA with GG09 Schnorr-like identity-based signatures (IBS). In the steady state, TF5 enables UEs to authenticate each SIB1 message using a symmetric MAC and delayed key disclosure, eliminating the need for per-message digital signatures. Initial trust is bootstrapped during cell entry using a lightweight GG09 IBS...

论文介绍 5G 基站广播的未认证系统信息易受伪基站攻击，现有数字签名方案给资源受限终端带来沉重计算负担。本文提出 TESLA-for-5G 协议，结合 TESLA 机制与轻量级身份签名。该协议在稳态下利用对称消息认证码与延迟密钥披露完成认证，消除了逐条消息的数字签名开销，有效兼顾了网络安全与终端能效。

VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills

第一作者: Ying Li · 方向: 安全研究

06/25 09:58

AI智能体运行时安全行为规约权限控制安全研究隐藏英文摘要

Agentic systems increasingly act through third-party skills, allowing model-generated decisions to affect files, communication channels, and cyber-physical devices. These skills often include natural-language specifications that define access permissions, disclosure limits, execution privileges, and required preconditions. Although such specifications describe the intended boundaries of skill behavior, they do not by themselves provide executable runtime enforcement. Enforcing them raises a contextual granularity challenge: even when a policy is written for a particular task context, a monitor must still decide which events to observe, what state to retain, how far across the execution to reason, and where to intervene. Choosing the wrong granularity can either block benign executions or miss violations that emerge only across multiple actions. Most existing enforcement mechanisms...

论文介绍 人工智能智能体日益依赖第三方技能执行任务，但其自然语言行为规约缺乏可执行的运行时强制机制。本文提出 VIGIL 框架，解决技能执行中的上下文粒度挑战。该系统通过动态决定事件观察、状态保留与干预位置，在运行时精确强制执行访问权限等安全边界，防止智能体在复杂多步操作中发生越权或违规行为。

DKVE: Decentralized Key Validation for End-to-End Encrypted Messaging

第一作者: Subin Song · 方向: 密码学协议

端到端加密公钥验证隐私保护中间人攻击社交图隐藏英文摘要

Abstract:End-to-end encrypted messaging systems depend on authentic public key distribution to prevent man-in-the-middle (MitM) attacks. Current solutions present a stark trade-off: out-of-band (OOB) verification provides strong security but lacks scalability for large contact lists, while key transparency (KT) systems enable automated verification at high storage costs and operational complexity. We propose DKVE, a protocol that validates public keys through privacy-preserving cross-validation within users' social graphs. When obtaining a contact's public key from a key server, clients query mutual contacts to verify they hold the same key, combining Oblivious Pseudorandom Functions (OPRF) and Oblivious Key-Value Stores (OKVS) to preserve privacy of both queries and contact lists. DKVE employs a Sequential Probability Ratio Test (SPRT) to aggregate responses and detect server...

论文介绍 针对端到端加密消息系统中公钥分发的中间人攻击风险，本文提出DKVE协议。该协议利用用户社交图进行隐私保护的公钥交叉验证，结合不经意伪随机函数与不经意键值存储技术，在验证密钥的同时保护查询与联系人列表隐私，为大规模联系人列表提供了一种兼顾安全与扩展性的去中心化验证方案。

Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents

第一作者: Praneeth Narisetty · 方向: AI 安全

大语言模型代理提示注入带外防御AI安全引用监控隐藏英文摘要

Abstract:Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions. Systems such as CaMeL, FIDES, Progent, RTBAS, and FORGE realize this with capabilities, information-flow labels, and reference monitors, and several report near-elimination of attacks on the AgentDojo benchmark. We make two contributions. First, we organize these out-of-band defenses as instances of classical integrity protection (Biba), reference monitoring, and least privilege, yielding a structured comparison of what they do and do not cover. Second, we warn that every one of them is validated only on static benchmarks (a fixed set of injection attempts), the same methodology that made...

论文介绍 针对大语言模型代理面临的间接提示注入攻击，本文系统评估了现有的带外防御机制。研究将这些防御策略映射为经典完整性保护与引用监控模型进行结构化比较，并指出当前防御仅在静态基准上验证的局限性，揭示了固定注入测试集无法全面评估动态环境下代理安全性的方法论缺陷。

What Browsers Do in the Shaders: A Measurement Study of WebGPU Privacy

第一作者: Igor Santos-Grueiro · 方向: 网络安全

WebGPU隐私泄漏浏览器安全指纹识别GPU状态隐藏英文摘要

Abstract:WebGPU lets ordinary web pages run GPU workloads through a validated programming model. Validation protects memory safety, but shared browser, driver, OS, and GPU state can still expose privacy-relevant signals. We present WGPULens, a framework for measuring those signals across controlled scenarios, browser-native co-residency, a participant field study, public page loads, and mitigation policies. Our framework separates measurements: controlled scenarios support leakage, boundary, and mitigation claims; participant runs support deployment, compatibility, and fingerprintability; and a Tranco crawl measures WebGPU exposure in real-world pages. Our controlled results identify persistent pipeline compilation state as the clearest surface. Cold/warm pipeline probes reveal prior compilation state across selected origin, profile, and browser placements. Controlled browser/native...

论文介绍 针对WebGPU在网页中运行GPU负载时可能引发的隐私泄露问题，本文提出WGPULens测量框架。通过在受控场景、真实页面加载及参与者研究中分离测量维度，研究发现持久管道编译状态是主要的隐私泄漏面，揭示了跨源和跨配置的GPU状态可被用于用户指纹识别，为浏览器隐私缓解策略提供依据。

Lessons from the Adoption and Deprecation of the Privacy Sandbox Web APIs

第一作者: Yohan Beugin · 方向: 网络安全

Privacy SandboxWeb隐私API弃用网络追踪纵向研究隐藏英文摘要

Abstract:While several web actors have been trying to reduce web tracking for years, it remains unclear how to achieve both desirable levels of utility and privacy. In 2019, Google launched the Privacy Sandbox initiative to balance that trade-off and find privacy alternatives to common use cases such as advertising. Yet, in late 2025, Google canceled the project and deprecated most of the newly introduced APIs. Despite its end, the Privacy Sandbox represents a unique opportunity to learn about how the ecosystem reacted to the proposed changes and make observations about why and how it failed. In this paper, we present a longitudinal measurement and analysis study of the Privacy Sandbox APIs to characterize their adoption and deprecation over the past seven years by different web actors. Leveraging historical HTTP Archive crawls and public Chrome telemetry data, we offer the largest...

论文介绍 本文对Google Privacy Sandbox Web API的采用与弃用过程进行纵向测量分析。通过挖掘历史HTTP Archive数据与Chrome遥测信息，研究刻画了不同网络参与者对该隐私API的采纳与废弃轨迹，为理解Web生态在隐私与实用性间的权衡及大型隐私倡议的演进提供了实证参考。

Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats

第一作者: Poojitha Thota · 方向: AI 安全

大语言模型意图验证危害评估AI安全对抗性攻击隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in interactive applications, yet they remain vulnerable to adversarial interactions that induce harmful, deceptive, or policy-violating outputs. Existing defenses typically analyze either user prompts or generated outputs, but not both. However, many real-world attacks exploit a separation between adversarial intent expressed in the prompt and actionable harm manifested only in the response. As a result, prompt-only and response-only defenses frequently miss unsafe interactions that appear benign when viewed from either side in isolation. We present a verification-centric defense framework that jointly evaluates prompt intent and response harm before an LLM response is delivered to a user. The framework employs specialized analysts for intent and harm assessment together with a Judge for conflict resolution. We formalize a...

论文介绍 针对大语言模型在交互中易受对抗性攻击的问题，本文提出一种联合验证提示意图与响应危害的统一防御框架。该框架在模型输出交付前，利用专门的意图与危害分析师进行双重评估，并引入仲裁机制解决冲突，有效弥补了单一分析提示或输出时容易遗漏的隐蔽不安全交互，提升了模型交互安全性。

Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model

第一作者: Sergey Kurilenko · 方向: 密码学协议

语义搜索隐私保护同态加密SVD截断向量数据库隐藏英文摘要

Abstract:Dense embeddings power semantic search and retrieval-augmented generation, but embedding-inversion attacks can reconstruct source text from a vector: when a vector database leaks, the documents behind it leak too. The textbook defences are extremes - encrypting the whole search homomorphically is sound but too slow at million-document scale, while privacy noise degrades ranking long before it protects. We study a middle path exploiting the asymmetry between the static collection and the dynamic query. The collection is protected geometrically: each vector is truncated onto a lower-dimensional SVD subspace and rotated by a secret orthogonal transform known only to the owner. The query is protected cryptographically: it is reranked under CKKS homomorphic encryption, so an honest-but-curious server never sees the query or the scores. CKKS parameters come from a small offline...

论文介绍 针对语义搜索中向量数据库泄露导致的文本重建风险，本文提出一种混合隐私保护方案。该方法对静态文档集合采用SVD子空间截断与秘密正交变换进行几何保护，对动态查询则利用CKKS同态加密进行密文重排序。此方案在保护文档与查询隐私的同时，有效平衡了大规模检索场景下的安全性与计算性能。

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

第一作者: Minjae Bae · 方向: 软件安全

供应链安全Go模块恶意代码检测AST扫描软件安全隐藏英文摘要

Abstract:We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a) a manual search on GitHub across 2,113 repositories and b) a large-scale scan of 12.3M index entries using a deobfuscating AST scanner (GOAST) that we implemented. As a result, we identified 2,289 malicious versions of legitimate Go modules. We demonstrate that purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Moreover, our proxy-based measurements of the takedown-remediation gap reveal that among artifacts later found to be GitHub-unobservable (i.e., removed or suspended), at least 99.4%...

论文介绍 本文针对Go生态系统中的自动化供应链攻击开展大规模测量研究。通过结合GitHub手动排查与自研的AST反混淆扫描工具，识别出两千余个恶意Go模块版本。研究揭示了仅依赖代码托管平台搜索的局限性，并量化了恶意模块在下架后的持久性残留问题，为完善开源生态的供应链安全治理提供了实证依据。

TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models

第一作者: William Aiken · 方向: 网络安全

扩散模型后门攻击数据投毒AI安全图像生成隐藏英文摘要

Abstract:Noise-based backdoor attacks on diffusion models typically rely on input-time trigger injection, untargeted activation, and out-of-distribution target generation. Such assumptions reduce both the stealthiness and the practical relevance of these attacks. In this work, we present TEMPO-Diffusion, a targeted backdoor framework that localizes the malicious distribution shift to a temporal, in-distribution exposure. TEMPO-Diffusion supports: (i) targeted attacks on and to specific classes, (ii) multiple sub-image backdoors that reconstruct specific features within multiple, different output images and at multiple locations, and (iii) in-painting with time-conditioned triggers. To study relevant, practical security concerns in leveraging backdoored diffusion models for synthetic training data, we also introduce CALISA: a balanced, region-aware traffic-sign dataset emphasizing...

论文介绍 针对扩散模型后门攻击隐蔽性不足的问题，本文提出TEMPO-Diffusion定向后门框架。该框架将恶意分布偏移限制在时间维度的分布内暴露，支持针对特定类别的多位置子图像后门及时间条件触发修复。研究还引入了区域感知的交通标志数据集，深入探讨了利用投毒模型生成合成训练数据时的实际安全隐患。

Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps

第一作者: Yeeun Jo · 方向: 网络安全

生育追踪应用隐私泄露网络流量分析第三方广告数据安全隐藏英文摘要

Abstract:While human factors in the privacy of fertility tracking apps -- health trackers that record user's menstrual or pregnancy data -- has been the subject of extensive study, little attention has been paid to the technical aspects of apps' data handling practices. We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store, focusing on how user data is shared with third party advertising services. After systematizing app features, we conduct a series of standardized user interactions across all apps in an environment that records TLS-stripped network traffic. In a subset of apps (n=5) we identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's. Equally importantly, we observe additional apps that use an ad-based monetization model without apparent...

论文介绍 本文针对生育追踪应用的用户健康数据泄露问题展开研究。作者对20款Android应用进行网络流量测量，分析其数据共享实践。研究发现部分应用存在显式的健康数据泄露，以及通过针对性广告URL导致的隐式泄露。该研究揭示了此类应用在广告变现模式下的隐私风险，为移动健康应用的数据安全评估提供了实证依据。

CyberChainBench: Can AI Agents Secure Smart Contracts Against Real-World On-Chain Vulnerabilities?

第一作者: Jintao Huang · 方向: 软件安全

智能合约安全大语言模型智能体漏洞检测基准测试DeFi安全隐藏英文摘要

Abstract:We present CyberChainBench, a benchmark for evaluating LLM-based agents on smart contract security across three complementary tasks: vulnerability detection, exploit generation, and patch synthesis. Built from 541 real-world exploit incidents from DeFiHackLabs spanning 9 EVM chains, the benchmark provides end-to-end on-chain evaluation where agents interact with historical blockchain state through isolated evaluation environments orchestrated by Harbor, using tools to read code, trace transactions, and validate exploits on mainnet forks. Each case is anchored to a specific block and includes structured ground truth covering vulnerability type, localization, and attacker profit. Exploits are graded by economic impact on historical forks; patches are validated by replaying historical attacks and legitimate transactions as fail-to-pass test oracles on a proxy-upgradeable subset...

论文介绍 本文提出CyberChainBench基准，评估大语言模型智能体在智能合约安全方面的能力。该基准涵盖漏洞检测、利用生成和补丁合成任务，基于真实的去中心化金融漏洞事件构建。通过隔离环境让智能体与历史链上状态交互，验证其安全分析与修复能力，为AI辅助智能合约安全研究提供标准化的端到端评估框架。

Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem

第一作者: Jin Gao · 方向: 密码学协议

06/25 01:35

多智能体系统元数据模式结构化数据交换NANDiniJSON隐藏英文摘要

NANDini (Networked Agents Natural Distillation of Interconnected Nodal Intelligence) envisions an automated ecosystem where intelligent agents independently create, process, and exchange data to drive decisions at scale. Realizing this vision requires infrastructure beyond agent discovery and communication: agents must be able to advertise, evaluate, and verify the datasets they hold. Current protocols, including NANDA for federated registry and A2A and MCP for inter-agent messaging, address identity and communication but provide no mechanism for structured data exchange. Existing enterprise data-sharing frameworks, such as IDS-RAM, Gaia-X, and Ocean Protocol, assume human-in-the-loop governance that is incompatible with autonomous, real-time agent interactions. We introduce Data Facts, a core NANDini concept: a lightweight JSON metadata schema that bridges agent discovery and data...

论文介绍 针对多智能体系统缺乏结构化数据交换机制的问题，本文提出Data Facts概念。这是一种轻量级JSON元数据模式，旨在桥接智能体发现与数据交换。与传统依赖人工干预的企业框架不同，该模式支持智能体自主、实时地发布、评估和验证数据集，为大规模自动化智能体协作提供了底层数据基础设施支持。

MIRAGE: Protecting against Malicious Image Editing via False Moderation

第一作者: Anshul Nasery · 方向: 系统安全

06/25 00:23

图像编辑安全预生成审核图像免疫系统安全AI生成内容隐藏英文摘要

The proliferation of AI-powered image editing systems raises serious concerns because it allows personal images to be arbitrarily manipulated at scale, with minimal effort, and a lower barrier to entry. Prior work on image immunization adds imperceptible perturbations to an image to protect against unauthorized manipulations. However, these methods usually require access to the model weights and the image manipulating prompt. This significantly limits their use, especially against powerful commercial image-editors such as GPT-Image, Gemini Flash Image (Nano Banana), and Grok Imagine. To address this, we take a system-level view of the problem and identify a previously unexplored attack surface common to all major commercial image editing systems: pre-generation safety moderation.Rather than disrupting the generative model itself, we propose to immunize images by causing these...

论文介绍 针对AI图像编辑系统导致的恶意篡改问题，本文提出MIRAGE方法。该方法利用商业图像编辑器普遍存在的预生成安全审核机制，通过触发虚假审核阻止未授权操纵。相比依赖模型权重的传统方法，该技术无需获取模型内部信息，能有效防御主流商业编辑系统的滥用，在系统层面提升了个人图像数据的安全性。

A Deterministic Control Plane for LLM Coding Agents

第一作者: Padmaraj Madatha · 方向: AI 安全

大语言模型智能体配置管理控制平面代码安全权限边界隐藏英文摘要

Abstract:LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to...

论文介绍 本文研究大语言模型编码智能体配置层缺乏管理的问题。分析发现智能体配置常作为未声明的共享组件跨组织传播，且极少更新或声明权限边界。为此，作者提出在智能体运行环境之上构建确定性控制平面，实现对配置文件的集中管理与权限控制，从而降低智能体在代码生成与执行过程中的安全及合规风险。

Autoformalization of Agent Instructions into Policy-as-Code

第一作者: Adam Mondl · 方向: 软件安全

智能体安全自动形式化策略即代码Cedar策略语言大语言模型隐藏英文摘要

Abstract:Agent safety in high-stakes domains requires formal policy enforcement, but most existing approaches either rely on probabilistic guardrails (fine-tuned classifiers, prompt-based steering) that offer no formal guarantees, or on hand-coded symbolic enforcement that does not scale to the breadth of real policy specifications. We present an autoformalization pipeline that translates agent prompts, MCP tool descriptions, and natural language policy documents into formally verified policies using an LLM-based generator-critic loop. The resulting policies are written in the Cedar Policy Language. On the MedAgentBench benchmark, our autoformalized policies cover substantially more of the source natural-language specification than the hand-coded symbolic enforcement in prior work.

论文介绍 针对智能体安全需形式化策略执行的问题，本文提出自动形式化管道。该方法利用大语言模型构建生成与评估循环，将智能体提示、工具描述及自然语言策略转化为形式化验证的策略代码。结果表明，生成的Cedar策略代码比手工规则更全面地覆盖自然语言规范，有效提升了智能体安全管控的可扩展性。

Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform

第一作者: Manar Alsaid · 方向: 软件安全

基础设施即代码Terraform大语言模型安全修复欺骗性修复隐藏英文摘要

Abstract:Security misconfigurations in Terraform Infrastructure-as-Code are a growing risk in cloud deployments, and large language models are increasingly used as automated repair agents. Existing evaluations often treat a repair as successful when the targeted static-analysis finding disappears, without checking planning validity, behavioral change, or security intent. This paper presents TerraProbe, a five-layer oracle framework for evaluating LLM-assisted Terraform security repair. We apply TerraProbe to 288 first-pass repairs generated by gemini-2.5-flash-lite, GPT-4o, and Claude 3.5 Sonnet across 68 real-world TerraDS modules and 28 controlled injected-defect modules. The results show that targeted Checkov removal overstates repair success. Although targeted removal reaches 83.3 percent for the primary model, full-scanner cleanliness drops to 10.4 percent, Terraform planning...

论文介绍 针对Terraform基础设施即代码的安全风险，本文提出TerraProbe五层框架，检测大语言模型辅助修复中的欺骗性修复。研究发现仅依赖静态分析的目标移除会高估修复成功率。该框架通过多层验证全面评估修复的有效性、行为变更与安全意图，为云环境下的自动化代码修复提供了更严谨的评估标准。

ProvenAI: Provenance-Native Traces of Evidence in Generated Answers

第一作者: Mohammad Faizan · 方向: 系统安全

06/25 07:22

检索增强生成引用保真度多跳问答溯源分析透明度隐藏英文摘要

Retrieval-augmented systems routinely present citations alongside generated answers, yet a citation does not confirm that the corresponding source meaningfully shaped the output. This paper introduces ProvenAI, a framework that decomposes transparency in multi-hop question answering into three independently measurable layers: answer correctness, citation fidelity against benchmark supporting evidence, and per-document influence under leave-one-resource-out intervention. Targeting the HotpotQA distractor benchmark through a seven-stage pipeline covering data normalisation, retrieval indexing, citation-aware answer generation, attribution auditing, ablation-based influence estimation, batch evaluation, and interactive inspection, ProvenAI evaluates 7,405 validation examples drawn from a canonical corpus of 509,300 passages. The system achieves 53.53% answer accuracy alongside a mean...

论文介绍 针对检索增强系统中引用无法证实来源真实影响答案的问题，本文提出ProvenAI框架。该框架将多跳问答透明度分解为答案正确性、引用保真度和单文档影响力三个可测层。通过归因审计和消融干预流水线，系统能精确评估各文档对生成结果的实际贡献，有效提升了生成式问答的可解释性与证据溯源能力。

Nanoelectromechanical Systems (NEMS) for Hardware Security in Advanced Packaging

第一作者: Himanandhan Reddy Kottur · 方向: 系统安全

纳米机电系统硬件安全物理不可克隆函数先进封装防篡改检测隐藏英文摘要

Abstract:As hardware security threats escalate across semiconductor manufacturing and advanced packaging, there is a growing need for novel physical mechanisms to counter sophisticated attacks such as tampering, counterfeiting, and supply chain infiltration. This paper presents Nanoelectromechanical Systems (NEMS) as an emerging class of hardware security primitives that enable physical assurance, tamper detection, and authentication at the device level. Leveraging mechanisms such as NEMS-based Physically Unclonable Functions (PUFs), shape memory materials, resonance-based fingerprints, and physical unlocking architectures, these systems offer enhanced resilience to reverse engineering, side-channel attacks, and environmental degradation. By harnessing mechanical unpredictability and fabrication-induced nanoscale variability, NEMS technologies introduce a physically robust and...

论文介绍 针对半导体先进封装中的硬件安全威胁，本文提出将纳米机电系统作为新兴硬件安全原语。该系统利用物理不可克隆函数、形状记忆材料及共振指纹等机制，在设备级实现物理保证与防篡改检测。该技术通过引入机械不可预测性与纳米级制造差异，有效提升了对逆向工程和侧信道攻击的防御能力。

Query Cost Model Calibration in Confidential Virtual Machines

第一作者: Qihan Zhang · 方向: 软件安全

06/25 05:11

机密计算机密虚拟机查询优化成本模型校准数据库性能隐藏英文摘要

With the growing adoption of Confidential Computing, running databases in confidential virtual machines (CVMs) such as AMD SEV-SNP has become an attractive way to protect sensitive cloud data with minimal changes to legacy DBMSs. However, analytical queries in such CVMs often suffer substantial overhead, and prior database work has largely stopped at benchmarking these slowdowns rather than optimizing them. We show that this problem stems from a hardware-software mismatch: query optimizers still rely on KVM-oriented (non-encrypted VM) cost assumptions that no longer hold in CVMs. To address this, we propose a lightweight CVM-aware cost calibration. It models two dominant sources of optimizer-facing overhead: data movement and RMP-related translation using simple physical proxies already available to the optimizer. Experiments show that the calibration significantly narrows the KVM/CVM...

论文介绍 针对机密虚拟机中数据库查询开销过大的问题，本文指出其根源在于查询优化器沿用了非加密虚拟机的成本假设。为此，提出一种轻量级成本校准方法，利用物理代理对数据移动和内存转换开销进行建模。该方法有效修正了成本假设偏差，降低了机密计算环境下的查询延迟，提升了数据库系统的执行效率。

Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems

第一作者: Jakob Salfeld-Nebgen · 方向: 软件安全

06/25 02:43

人工智能治理自主代理制度证明高风险操作防篡改日志隐藏英文摘要

Autonomous AI agents may begin to perform consequential, irreversible actions such as clinical prescribing and production software deployment. This paper observes that human institutions have governed powerful autonomous actors not by monitoring their reasoning but by requiring independently attested evidence at the point of consequential action. We formalise this institutional pattern as a computational governance model for AI agent systems. Under the proposed model, an agent retains full autonomy over planning and reasoning but holds no execution authority over designated high-risk actions. Execution is conditional on preconditions that are each independently attested by a separate authoritative source, cryptographically bound to a declared intent, and evaluated by a deterministic policy. Decisions are recorded in a tamper-evident log amenable to independent re-verification. We...

论文介绍 针对自主AI执行高风险操作的安全问题，本文提出基于「制度证明」的计算治理模型。该模型允许AI保留推理自主权，但将其高风险操作的执行权与独立权威来源的密码学证明绑定。通过确定性策略评估前置条件，并将决策记录于防篡改日志以供验证，在不干预AI推理的前提下实现了安全可控的行动治理。

The Role of Input Dimensionality in the Emergence and Targeted Control of Adversarial Examples

第一作者: Nasrin Malekzadeh Goradel · 方向: AI 安全

对抗样本输入维度深度学习测度集中鲁棒性隐藏英文摘要

Abstract:Several theoretical works have tried to explain the adversarial vulnerability of deep neural networks through properties of high-dimensional geometry. However, the assumptions underlying these works are rarely examined empirically, and systematic evidence remains limited. In this work, we present a systematic study of the role of input dimensionality in both the emergence and the targeted control of adversarial examples. We first analyse the scope and limitations of existing theoretical frameworks based on concentration of measure, showing that real image classes exhibit strong empirical localization, beyond what such theories typically assume. We then conduct an extensive empirical evaluation across hierarchical image datasets spanning a wide range of input dimensionalities and diverse neural architectures. Our results consistently show that adversarial examples become easier...

论文介绍 本文系统研究输入维度在深度神经网络对抗样本产生与定向控制中的作用。通过分析基于测度集中的理论框架，发现真实图像表现出强烈的经验局部化。研究在跨越多维度输入和多种架构的图像数据集上进行广泛评估，揭示了输入维度变化对对抗样本生成难度及模型脆弱性的影响，为理解对抗鲁棒性提供了实证依据。

Federated Hash Projected Latent Factor Learning

第一作者: Jialan He · 方向: 软件安全

06/24 22:40

联邦学习哈希学习隐私保护潜在因子二进制表示隐藏英文摘要

Hash Learning (HL) is an efficient representation learning approach that maps real-valued data into compact binary representations. Traditional HL methods typically require users to upload personal data to a central server, which is incompatible with increasingly stringent data security regulations. Federated Learning (FL) provides a decentralized paradigm for learning globally optimal models without centralizing private data. However, most FL methods rely on transmitting large-scale real-valued gradient information, leading to high communication overhead and potential privacy risks. Integrating HL into FL is a promising solution. Nevertheless, existing HL methods suffer from limited representational capacity of binary codes, which may degrade model accuracy. To address this challenge, we propose a Federated Hash Projected Latent Factor (FHPLF) model. FHPLF introduces three key...

论文介绍 针对传统哈希学习需集中数据及联邦学习中梯度传输开销大的问题，本文提出联邦哈希投影潜在因子模型。该方法将哈希学习引入联邦范式，在避免集中私有数据的同时降低通信开销。通过引入关键机制解决现有二进制码表示能力受限导致精度下降的挑战，实现了高效且隐私安全的分布式表示学习。

Account-History Features for Social Bot Detection in the Era of Large Language Models

第一作者: Gaurang Katyal · 方向: 安全研究

社交机器人检测账户历史特征大语言模型随机森林特征工程隐藏英文摘要

Abstract:Bot detection on social platforms has historically relied on a mix of account-metadata features and features extracted from the text of posts and profile fields. The arrival of capable language models complicates the latter. A bot operator can run every post through GPT-4 or Claude and produce text whose surface statistics are difficult to distinguish from those of human writing, which weakens the predictive value of content-derived features. This paper asks how much of the detection problem can be solved by features that an attacker cannot easily manipulate at low cost: the age of the account, follower and friend counts and their ratios, profile completeness, and the structural properties of the handle. On a publicly redistributed corpus of 2,432 Twitter accounts with manually verified labels (43.0% bots), a random forest using only these account-history features achieves...

论文介绍 大语言模型使社交机器人能轻易生成逼真文本，导致传统内容检测特征失效。本文提出利用攻击者难以低成本操纵的账户历史特征进行检测，包括账户年龄、粉丝与关注比例、资料完整度及句柄结构属性。研究表明，仅依赖这些历史特征的模型即可实现高效的机器人识别，为平台安全治理提供了低成本方案。