2026-06-28

MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG

第一作者: Inderjeet Singh · 方向: AI 安全

检索增强生成红队测试蒙特卡洛树搜索多模态智能体人工智能安全隐藏英文摘要

Abstract:Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning...

论文介绍 针对多模态智能体检索增强生成系统攻击面扩大且现有红队测试方法高度重复的问题，本文提出统一跨表面红队框架。该方法在明确的新颖性约束下，执行基于记忆引导的蒙特卡洛树搜索，并利用检索上下文调节候选生成。研究有效避免了提示词复制，显著提升了跨模态攻击表面的红队测试覆盖率与有效性。

MergeLLL: A Hierarchical Divide-and-Conquer Framework for LLL-Based Lattice Reduction

第一作者: Niharika Gauraha · 方向: 密码学协议

格基规约分治策略LLL算法密码学隐藏英文摘要

Abstract:Lattice basis reduction algorithms have various applications in computational number theory and lattice-based cryptography, but their complexity increases rapidly with the dimension. Motivated by the divide-and-conquer strategy of merge sort and incorporating PotLLL-style deep insertions during recombination, MergeLLL is proposed. In this framework, a lattice basis is split into sub-bases, local reductions are performed independently, and the full basis is reconstructed through hierarchical merging. The approach is focused on improving local lattice structure first before global basis properties are refined, resulting in enhanced Gram-Schmidt orthogonality and numerical stability, while overall computational cost is reduced. The method is naturally parallelizable, allowing efficient multicore and distributed execution. It is shown that the reduction and merging steps preserve...

论文介绍 针对格基规约算法复杂度随维度快速增长的问题，本文提出MergeLLL分层分治框架。该方法将格基分裂为子基进行独立局部规约，并结合深度插入策略进行分层合并。此方法优先优化局部格结构，提升Gram-Schmidt正交性与数值稳定性，降低计算成本，且支持并行执行，适用于高维格密码分析。

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

第一作者: Christian Scano · 方向: 软件安全

06/25 15:37

安卓恶意软件对抗性攻击问题空间机器学习检测隐藏英文摘要

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire benign modules, introducing many side-effect features and often causing build-time failures. Fine-grained methods that inject only a narrow subset of components exhibit limited effectiveness, while those that also use obfuscation rely on brittle bytecode rewriting, producing APKs that are syntactically valid but semantically unusable. Prior work further overestimates attack success rates by running smoke tests that only validate installation and basic execution, without assessing whether the modified APK still preserves its intended behavior. To overcome these limitations, we present DROIDBREAKER...

论文介绍 针对机器学习安卓恶意软件检测的问题空间对抗攻击存在构建失败或功能损坏等缺陷，本文提出DroidBreaker框架。该方法能生成既规避检测又保留原有功能的实用对抗性APK，克服了传统软件移植和字节码重写带来的副作用问题，为评估和提升安卓恶意软件检测器的鲁棒性提供了有效的测试工具。

The Fungible Reserve Standard: A Deterministic Framework for Encoding Carrying Costs in Asset-Backed Tokens

第一作者: JJ Jia Jing Tan · 方向: 区块链安全

现实世界资产代币化持有成本区块链DeFi隐藏英文摘要

Abstract:The tokenization of real-world assets (RWAs) has emerged as a transformative application of blockchain technology, with market projections estimating trillions of dollars in tokenized assets within the coming decade. However, a fundamental challenge remains unaddressed: physical assets such as precious metals, stored commodities, and warehoused goods incur structural negative carry -- custody, insurance, and audit costs that accumulate over time. While existing tokenization models have successfully established the market for digital gold and treasuries, they typically manage operational costs at the issuer level. The FRS introduces a framework to bring these economics directly on-chain, avoiding mechanisms such as token rebasing that compromise fungibility and composability with decentralized finance (DeFi) protocols. This paper proposes the Fungible Reserve Standard (FRS), a...

论文介绍 现实世界资产代币化面临物理资产持有成本累积的挑战，现有模型通常在发行者层面处理。本文提出可互换储备标准（FRS），将持有成本经济学直接引入链上。该确定性框架避免了代币重定基等损害资产可互换性与DeFi组合性的机制，为贵金属、大宗商品等实体资产的链上代币化提供了更优的经济模型解决方案。

TGHE: Template-based Graph Homomorphic Encryption for Privacy-Preserving GNN Inference in Edge-Cloud Systems

第一作者: Ngoc Bao Anh Le · 方向: 密码学协议

图神经网络同态加密隐私保护边缘计算SIMD隐藏英文摘要

Abstract:Existing homomorphic encryption (HE)-based GNN systems adopt a graph-centric paradigm that couples per-query cost to global graph size, limiting evaluations to at most ~20k nodes and making them incompatible with dynamic, large-scale financial graphs. We propose TGHE (Template-based Graph Homomorphic Encryption), an ego-centric framework that resolves this by exploiting a template phenomenon: local computation trees in transaction graphs converge into a small set of structural shapes. TGHE canonicalizes ego-graphs at the edge and packs structurally identical trees into shared CKKS ciphertexts for SIMD-parallel encrypted inference, with two long-tail optimizers (Approximate Template Fitting and Topology Collapse) ensuring full SIMD coverage. On DGraphFin (3.7M nodes, 4.3M edges), TGHE-Collapse achieves a 66.9x speedup over the sequential encrypted baseline with less than 0.002...

论文介绍 现有基于同态加密的图神经网络计算成本随全局图规模急剧增加。本文提出TGHE框架，利用交易图局部计算树的模板现象，在边缘端规范化子图并将结构相同的树打包至共享密文中，实现SIMD并行加密推理。该方法大幅降低了大规模金融图的隐私推理延迟，有效提升了边云系统中图数据处理的效率与安全性。

Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents

第一作者: Nada Lahjouji · 方向: AI 安全

大语言模型智能体隐私保护数据安全数据泄露隐藏英文摘要

Abstract:Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf. As they move from answering questions to operating over sensitive data, privacy becomes harder to enforce. An agent touches many data sources, runs multi-step workflows, keeps state across sessions, and acts with delegated permissions. Sensitive information can therefore leak not only through its final answer but through the queries it issues, the intermediate results it handles, the memory it writes, and the messages it exchanges with other agents. We survey the privacy of LLM agents from a data-centric view, organizing the field around the data an agent touches rather than by attack type, and we use data agent as shorthand for an LLM agent that works with data. Research on these risks is active but scattered across...

论文介绍 大语言模型智能体处理敏感数据时面临隐私泄露风险，信息可能通过查询、中间结果、内存及消息交互等途径泄露。本文从数据中心视角对智能体隐私进行综述，围绕智能体接触的数据类型而非攻击方式组织研究框架。该工作系统梳理了数据交互中的隐私风险，为构建安全合规的数据驱动型智能体提供了理论参考。

Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models

第一作者: Abrar Alotaibi · 方向: AI 安全

对抗性攻击扩散模型多模态大语言模型视觉语言模型隐藏英文摘要

Abstract:Adversarial evaluation of AI systems has matured along four largely disconnected tracks: diffusion-based attacks on text and large language models (LLMs), diffusion-based attacks on image classifiers, jailbreak pipelines against vision-language models, and diffusion-based input purification defenses. Each has developed its own vocabulary, threat models, and benchmarks, with denoising diffusion models emerging as a shared generative mechanism whose recipes are now actively ported between communities. This survey performs an information-fusion exercise at the meta-research level: we integrate these four tracks into a single conceptual framework with a unified taxonomy, evaluation criteria, and research agenda, focusing on the LLM-side slice. We catalog fifty published papers across four scope areas (text/LLM, image classifier, vision-language model, defense), plus four...

论文介绍 针对人工智能系统的对抗性评估在文本、图像、视觉语言模型及防御四个领域独立发展。本文在元研究层面进行信息融合，将基于扩散模型的跨模态攻击与防御整合至统一概念框架。该综述建立统一的分类法与评估标准，梳理跨社区的技术迁移，为多模态大模型的安全性评估与鲁棒性研究提供了系统性的研究议程。

TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA

第一作者: Subin Song · 方向: 密码学协议

5G网络广播认证TESLA协议系统信息基于身份签名隐藏英文摘要

Abstract:5G base stations broadcast unauthenticated system information (SI) that every user equipment (UE) reads during cell selection. This enables attackers to broadcast forged SI from a fake base station (FBS), deceiving UEs into camping on it. Prior approaches require UEs to authenticate System Information Block 1 (SIB1) using digital signatures. This necessitates computation-heavy verification for every SIB1 reception, imposing a significant burden on resource-constrained UEs. We propose TESLA-for-5G (TF5), a broadcast authentication protocol for 5G SIB1 that combines TESLA with GG09 Schnorr-like identity-based signatures (IBS). In the steady state, TF5 enables UEs to authenticate each SIB1 message using a symmetric MAC and delayed key disclosure, eliminating the need for per-message digital signatures. Initial trust is bootstrapped during cell entry using a lightweight GG09 IBS...

论文介绍 5G基站广播未认证的系统信息易受伪造基站攻击，现有数字签名认证方案计算负担重。本文提出TESLA-for-5G协议，结合TESLA与基于身份的签名机制。该协议在稳态下利用对称MAC和延迟密钥披露进行消息认证，消除逐条数字签名开销，在保障资源受限设备安全接入的同时，大幅降低了认证计算成本。

VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills

第一作者: Ying Li · 方向: 安全研究

06/25 09:58

AI智能体运行时强制行为规范权限控制安全研究隐藏英文摘要

Agentic systems increasingly act through third-party skills, allowing model-generated decisions to affect files, communication channels, and cyber-physical devices. These skills often include natural-language specifications that define access permissions, disclosure limits, execution privileges, and required preconditions. Although such specifications describe the intended boundaries of skill behavior, they do not by themselves provide executable runtime enforcement. Enforcing them raises a contextual granularity challenge: even when a policy is written for a particular task context, a monitor must still decide which events to observe, what state to retain, how far across the execution to reason, and where to intervene. Choosing the wrong granularity can either block benign executions or miss violations that emerge only across multiple actions. Most existing enforcement mechanisms...

论文介绍 智能体通过第三方技能执行任务时，其行为规范缺乏可执行的运行时强制机制。本文提出VIGIL系统，解决行为监控中的上下文粒度挑战。该系统能精确决定观测事件、保留状态及干预位置，在运行时强制执行技能的访问权限与执行特权，有效防止智能体越权操作，提升了复杂代理系统的安全性和可控性。

DKVE: Decentralized Key Validation for End-to-End Encrypted Messaging

第一作者: Subin Song · 方向: 密码学协议

端到端加密公钥验证隐私保护社交图隐藏英文摘要

Abstract:End-to-end encrypted messaging systems depend on authentic public key distribution to prevent man-in-the-middle (MitM) attacks. Current solutions present a stark trade-off: out-of-band (OOB) verification provides strong security but lacks scalability for large contact lists, while key transparency (KT) systems enable automated verification at high storage costs and operational complexity. We propose DKVE, a protocol that validates public keys through privacy-preserving cross-validation within users' social graphs. When obtaining a contact's public key from a key server, clients query mutual contacts to verify they hold the same key, combining Oblivious Pseudorandom Functions (OPRF) and Oblivious Key-Value Stores (OKVS) to preserve privacy of both queries and contact lists. DKVE employs a Sequential Probability Ratio Test (SPRT) to aggregate responses and detect server...

论文介绍 针对端到端加密消息系统中公钥验证的安全与扩展性权衡问题，本文提出DKVE协议。该方法利用用户社交图进行隐私保护的交叉验证，结合不经意伪随机函数与不经意键值存储技术，在验证公钥的同时保护查询与联系人列表隐私，为大规模安全通信提供了去中心化的轻量级解决方案。

Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents

第一作者: Praneeth Narisetty · 方向: AI 安全

大语言模型代理提示注入带外防御AI安全隐藏英文摘要

Abstract:Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions. Systems such as CaMeL, FIDES, Progent, RTBAS, and FORGE realize this with capabilities, information-flow labels, and reference monitors, and several report near-elimination of attacks on the AgentDojo benchmark. We make two contributions. First, we organize these out-of-band defenses as instances of classical integrity protection (Biba), reference monitoring, and least privilege, yielding a structured comparison of what they do and do not cover. Second, we warn that every one of them is validated only on static benchmarks (a fixed set of injection attempts), the same methodology that made...

论文介绍 针对大语言模型代理面临的间接提示注入威胁，本文对现有的带外防御机制进行系统性评估。研究将这些防御策略映射为经典完整性保护与最小权限原则，并进行结构化对比分析。同时指出当前防御方案仅依赖静态基准测试的局限性，为构建更具适应性和鲁棒性的AI代理安全框架提供了重要参考。

What Browsers Do in the Shaders: A Measurement Study of WebGPU Privacy

第一作者: Igor Santos-Grueiro · 方向: 网络安全

WebGPU隐私泄露浏览器安全侧信道隐藏英文摘要

Abstract:WebGPU lets ordinary web pages run GPU workloads through a validated programming model. Validation protects memory safety, but shared browser, driver, OS, and GPU state can still expose privacy-relevant signals. We present WGPULens, a framework for measuring those signals across controlled scenarios, browser-native co-residency, a participant field study, public page loads, and mitigation policies. Our framework separates measurements: controlled scenarios support leakage, boundary, and mitigation claims; participant runs support deployment, compatibility, and fingerprintability; and a Tranco crawl measures WebGPU exposure in real-world pages. Our controlled results identify persistent pipeline compilation state as the clearest surface. Cold/warm pipeline probes reveal prior compilation state across selected origin, profile, and browser placements. Controlled browser/native...

论文介绍 针对WebGPU技术在网页中运行GPU负载时可能引发的隐私泄露问题，本文提出WGPULens测量框架。该框架在受控场景、真实页面加载及缓解策略下，系统评估浏览器、驱动与GPU共享状态暴露的隐私信号。研究揭示了持久管道编译状态等关键泄露面，为WebGPU的隐私保护与浏览器安全设计提供了实证依据。

Lessons from the Adoption and Deprecation of the Privacy Sandbox Web APIs

第一作者: Yohan Beugin · 方向: 网络安全

隐私沙盒网络追踪Web API隐私保护隐藏英文摘要

Abstract:While several web actors have been trying to reduce web tracking for years, it remains unclear how to achieve both desirable levels of utility and privacy. In 2019, Google launched the Privacy Sandbox initiative to balance that trade-off and find privacy alternatives to common use cases such as advertising. Yet, in late 2025, Google canceled the project and deprecated most of the newly introduced APIs. Despite its end, the Privacy Sandbox represents a unique opportunity to learn about how the ecosystem reacted to the proposed changes and make observations about why and how it failed. In this paper, we present a longitudinal measurement and analysis study of the Privacy Sandbox APIs to characterize their adoption and deprecation over the past seven years by different web actors. Leveraging historical HTTP Archive crawls and public Chrome telemetry data, we offer the largest...

论文介绍 针对Web生态中隐私保护与实用性的平衡难题，本文对Google「隐私沙盒」API的采用与弃用过程进行纵向实证分析。通过挖掘历史网页归档与浏览器遥测数据，研究系统刻画了七年间不同网络参与者对该隐私替代方案的响应与演进。该工作为理解大型隐私倡议的落地困境及未来Web标准设计提供了深刻教训。

Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats

第一作者: Poojitha Thota · 方向: AI 安全

大语言模型意图验证安全防御AI对齐隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in interactive applications, yet they remain vulnerable to adversarial interactions that induce harmful, deceptive, or policy-violating outputs. Existing defenses typically analyze either user prompts or generated outputs, but not both. However, many real-world attacks exploit a separation between adversarial intent expressed in the prompt and actionable harm manifested only in the response. As a result, prompt-only and response-only defenses frequently miss unsafe interactions that appear benign when viewed from either side in isolation. We present a verification-centric defense framework that jointly evaluates prompt intent and response harm before an LLM response is delivered to a user. The framework employs specialized analysts for intent and harm assessment together with a Judge for conflict resolution. We formalize a...

论文介绍 针对大语言模型在交互应用中易受对抗性攻击的问题，本文提出一种联合验证提示意图与响应危害的统一防御框架。该方法突破单一侧分析的局限，在模型输出前通过专门的意图与危害分析师及冲突裁决机制，全面评估交互安全性。此框架有效弥补了现有防御的盲区，为提升大模型应用的端到端安全提供了新思路。

Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model

第一作者: Sergey Kurilenko · 方向: 密码学协议

语义搜索同态加密隐私保护向量数据库隐藏英文摘要

Abstract:Dense embeddings power semantic search and retrieval-augmented generation, but embedding-inversion attacks can reconstruct source text from a vector: when a vector database leaks, the documents behind it leak too. The textbook defences are extremes - encrypting the whole search homomorphically is sound but too slow at million-document scale, while privacy noise degrades ranking long before it protects. We study a middle path exploiting the asymmetry between the static collection and the dynamic query. The collection is protected geometrically: each vector is truncated onto a lower-dimensional SVD subspace and rotated by a secret orthogonal transform known only to the owner. The query is protected cryptographically: it is reranked under CKKS homomorphic encryption, so an honest-but-curious server never sees the query or the scores. CKKS parameters come from a small offline...

论文介绍 针对语义搜索中向量数据库泄露导致的源文本重构风险，本文提出一种混合隐私感知搜索方案。该方法利用SVD截断与秘密正交变换对静态文档集合进行几何保护，同时采用CKKS同态加密对动态查询进行密文重排序。此方案结合几何与密码学技术，在保障数据隐私的同时，有效兼顾了大规模文档检索的计算效率。

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

第一作者: Minjae Bae · 方向: 软件安全

供应链安全Go语言恶意模块软件安全隐藏英文摘要

Abstract:We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a) a manual search on GitHub across 2,113 repositories and b) a large-scale scan of 12.3M index entries using a deobfuscating AST scanner (GOAST) that we implemented. As a result, we identified 2,289 malicious versions of legitimate Go modules. We demonstrate that purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Moreover, our proxy-based measurements of the takedown-remediation gap reveal that among artifacts later found to be GitHub-unobservable (i.e., removed or suspended), at least 99.4%...

论文介绍 针对Go生态系统中的自动化供应链攻击，本文通过GitHub手动排查与自研GOAST扫描器对千万级索引进行大规模测量，识别出两千余个恶意模块版本。研究揭示了仅依赖平台代码托管搜索的局限性，并量化了模块下架后的持久性残留问题，为完善开源软件供应链的威胁检测与长效治理机制提供了关键的实证数据。

TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models

第一作者: William Aiken · 方向: 网络安全

扩散模型后门攻击数据投毒模型安全隐藏英文摘要

Abstract:Noise-based backdoor attacks on diffusion models typically rely on input-time trigger injection, untargeted activation, and out-of-distribution target generation. Such assumptions reduce both the stealthiness and the practical relevance of these attacks. In this work, we present TEMPO-Diffusion, a targeted backdoor framework that localizes the malicious distribution shift to a temporal, in-distribution exposure. TEMPO-Diffusion supports: (i) targeted attacks on and to specific classes, (ii) multiple sub-image backdoors that reconstruct specific features within multiple, different output images and at multiple locations, and (iii) in-painting with time-conditioned triggers. To study relevant, practical security concerns in leveraging backdoored diffusion models for synthetic training data, we also introduce CALISA: a balanced, region-aware traffic-sign dataset emphasizing...

论文介绍 针对扩散模型后门攻击隐蔽性与实用性不足的问题，本文提出TEMPO-Diffusion定向后门框架。该方法将恶意分布偏移精准定位至时间维度的分布内暴露，支持多类别定向攻击、多位置特征重建及时间条件触发修复。研究还引入了平衡的区域感知数据集，深入揭示了后门模型在生成合成训练数据时的潜在安全威胁。

Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps

第一作者: Yeeun Jo · 方向: 网络安全

06/25 02:17

隐私泄露生育追踪应用网络流量分析第三方广告隐藏英文摘要

While human factors in the privacy of fertility tracking apps -- health trackers that record user's menstrual or pregnancy data -- has been the subject of extensive study, little attention has been paid to the technical aspects of apps' data handling practices. We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store, focusing on how user data is shared with third party advertising services. After systematizing app features, we conduct a series of standardized user interactions across all apps in an environment that records TLS-stripped network traffic. In a subset of apps (n=5) we identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's. Equally importantly, we observe additional apps that use an ad-based monetization model without apparent leakage of...

论文介绍 本文针对生育追踪应用的健康数据隐私问题，对20款Android应用进行网络流量测量。研究评估了应用与第三方广告的数据共享行为，发现部分应用存在显式健康数据泄露及通过定向广告URL的隐式泄露。该研究揭示了移动健康应用在广告变现下的数据安全隐患，为隐私保护监管提供技术依据。

CyberChainBench: Can AI Agents Secure Smart Contracts Against Real-World On-Chain Vulnerabilities?

第一作者: Jintao Huang · 方向: 软件安全

智能合约安全大语言模型智能体漏洞检测基准测试隐藏英文摘要

Abstract:We present CyberChainBench, a benchmark for evaluating LLM-based agents on smart contract security across three complementary tasks: vulnerability detection, exploit generation, and patch synthesis. Built from 541 real-world exploit incidents from DeFiHackLabs spanning 9 EVM chains, the benchmark provides end-to-end on-chain evaluation where agents interact with historical blockchain state through isolated evaluation environments orchestrated by Harbor, using tools to read code, trace transactions, and validate exploits on mainnet forks. Each case is anchored to a specific block and includes structured ground truth covering vulnerability type, localization, and attacker profit. Exploits are graded by economic impact on historical forks; patches are validated by replaying historical attacks and legitimate transactions as fail-to-pass test oracles on a proxy-upgradeable subset...

论文介绍 本文提出CyberChainBench基准，评估大语言模型智能体在智能合约安全中的漏洞检测、利用生成与补丁合成能力。该基准基于真实链上漏洞事件构建，提供端到端隔离环境，使智能体能与历史区块链状态交互并验证修复效果。此工作为衡量AI在去中心化金融安全中的防御能力提供了标准化框架。

Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem

第一作者: Jin Gao · 方向: 密码学协议

06/25 01:35

多智能体系统数据交换元数据模式JSON隐藏英文摘要

NANDini (Networked Agents Natural Distillation of Interconnected Nodal Intelligence) envisions an automated ecosystem where intelligent agents independently create, process, and exchange data to drive decisions at scale. Realizing this vision requires infrastructure beyond agent discovery and communication: agents must be able to advertise, evaluate, and verify the datasets they hold. Current protocols, including NANDA for federated registry and A2A and MCP for inter-agent messaging, address identity and communication but provide no mechanism for structured data exchange. Existing enterprise data-sharing frameworks, such as IDS-RAM, Gaia-X, and Ocean Protocol, assume human-in-the-loop governance that is incompatible with autonomous, real-time agent interactions. We introduce Data Facts, a core NANDini concept: a lightweight JSON metadata schema that bridges agent discovery and data...

论文介绍 针对多智能体生态缺乏结构化数据交换机制的问题，本文提出Data Facts概念。这是一种轻量级JSON元数据模式，旨在桥接智能体发现与数据交换。该模式解决了现有通信协议和需人工干预的企业框架无法支持自主实时交互的局限，为大规模自动化智能体数据协作提供了基础设施支持。

MIRAGE: Protecting against Malicious Image Editing via False Moderation

第一作者: Anshul Nasery · 方向: 系统安全

图像安全恶意编辑防御虚假审核预生成安全检查隐藏英文摘要

Abstract:The proliferation of AI-powered image editing systems raises serious concerns because it allows personal images to be arbitrarily manipulated at scale, with minimal effort, and a lower barrier to entry. Prior work on image immunization adds imperceptible perturbations to an image to protect against unauthorized manipulations. However, these methods usually require access to the model weights and the image manipulating prompt. This significantly limits their use, especially against powerful commercial image-editors such as GPT-Image, Gemini Flash Image (Nano Banana), and Grok Imagine. To address this, we take a system-level view of the problem and identify a previously unexplored attack surface common to all major commercial image editing systems: pre-generation safety this http URL than disrupting the generative model itself, we propose to immunize images by causing these...

论文介绍 针对AI图像编辑系统带来的恶意篡改风险，本文提出MIRAGE防御方法。不同于依赖模型权重的传统技术，MIRAGE利用商业图像编辑系统共有的预生成安全检查机制，通过添加扰动触发虚假审核，从而阻止未授权的恶意编辑。该方法为保护个人图像免受闭源模型滥用提供了系统级防御新思路。

A Deterministic Control Plane for LLM Coding Agents

第一作者: Padmaraj Madatha · 方向: AI 安全

大语言模型智能体代码生成配置管理确定性控制平面隐藏英文摘要

Abstract:LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to...

论文介绍 本文研究大语言模型编码智能体配置层缺乏管理的问题。通过分析万余个GitHub仓库，发现智能体配置常作为未声明组件跨仓库传播，且极少更新或声明权限边界。为此，研究提出一种确定性控制平面，将智能体配置映射为可管理组件，旨在规范AI编码智能体的行为边界，提升代码生成过程的安全性与可控性。

Autoformalization of Agent Instructions into Policy-as-Code

第一作者: Adam Mondl · 方向: 软件安全

智能体安全策略即代码自动形式化Cedar策略语言隐藏英文摘要

Abstract:Agent safety in high-stakes domains requires formal policy enforcement, but most existing approaches either rely on probabilistic guardrails (fine-tuned classifiers, prompt-based steering) that offer no formal guarantees, or on hand-coded symbolic enforcement that does not scale to the breadth of real policy specifications. We present an autoformalization pipeline that translates agent prompts, MCP tool descriptions, and natural language policy documents into formally verified policies using an LLM-based generator-critic loop. The resulting policies are written in the Cedar Policy Language. On the MedAgentBench benchmark, our autoformalized policies cover substantially more of the source natural-language specification than the hand-coded symbolic enforcement in prior work.

论文介绍 针对高风险领域智能体安全策略难以形式化执行的问题，本文提出一种自动形式化管道。该方法利用大语言模型生成器与评论器循环，将自然语言策略、智能体提示及工具描述转化为基于Cedar语言的形式化验证策略。实验表明，该方法比手工编码覆盖更多规范，为智能体安全提供了可扩展的强制保障。

Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform

第一作者: Manar Alsaid · 方向: 软件安全

基础设施即代码Terraform大语言模型安全修复隐藏英文摘要

Abstract:Security misconfigurations in Terraform Infrastructure-as-Code are a growing risk in cloud deployments, and large language models are increasingly used as automated repair agents. Existing evaluations often treat a repair as successful when the targeted static-analysis finding disappears, without checking planning validity, behavioral change, or security intent. This paper presents TerraProbe, a five-layer oracle framework for evaluating LLM-assisted Terraform security repair. We apply TerraProbe to 288 first-pass repairs generated by gemini-2.5-flash-lite, GPT-4o, and Claude 3.5 Sonnet across 68 real-world TerraDS modules and 28 controlled injected-defect modules. The results show that targeted Checkov removal overstates repair success. Although targeted removal reaches 83.3 percent for the primary model, full-scanner cleanliness drops to 10.4 percent, Terraform planning...

论文介绍 针对大模型修复Terraform基础设施代码安全配置时产生欺骗性修复的问题，本文提出TerraProbe五层评估框架。该框架不仅检查静态分析警告是否消除，还验证规划有效性与安全意图。研究发现仅消除特定警告会严重高估修复成功率，此框架为准确评估AI代码修复的真实安全性提供了可靠工具。

ProvenAI: Provenance-Native Traces of Evidence in Generated Answers

第一作者: Mohammad Faizan · 方向: 系统安全

06/25 07:22

检索增强生成溯源分析引用保真度多跳问答隐藏英文摘要

Retrieval-augmented systems routinely present citations alongside generated answers, yet a citation does not confirm that the corresponding source meaningfully shaped the output. This paper introduces ProvenAI, a framework that decomposes transparency in multi-hop question answering into three independently measurable layers: answer correctness, citation fidelity against benchmark supporting evidence, and per-document influence under leave-one-resource-out intervention. Targeting the HotpotQA distractor benchmark through a seven-stage pipeline covering data normalisation, retrieval indexing, citation-aware answer generation, attribution auditing, ablation-based influence estimation, batch evaluation, and interactive inspection, ProvenAI evaluates 7,405 validation examples drawn from a canonical corpus of 509,300 passages. The system achieves 53.53% answer accuracy alongside a mean...

论文介绍 针对检索增强系统中引用无法证明来源实际影响生成结果的问题，本文提出ProvenAI框架。该框架将多跳问答透明度分解为答案正确性、引用保真度和单文档影响力三个独立测量层。通过七阶段管道，ProvenAI能精确审计归因并评估资源影响力，为提升生成式AI的可解释性与事实溯源能力提供系统方案。

Nanoelectromechanical Systems (NEMS) for Hardware Security in Advanced Packaging

第一作者: Himanandhan Reddy Kottur · 方向: 系统安全

纳米机电系统硬件安全物理不可克隆函数先进封装隐藏英文摘要

Abstract:As hardware security threats escalate across semiconductor manufacturing and advanced packaging, there is a growing need for novel physical mechanisms to counter sophisticated attacks such as tampering, counterfeiting, and supply chain infiltration. This paper presents Nanoelectromechanical Systems (NEMS) as an emerging class of hardware security primitives that enable physical assurance, tamper detection, and authentication at the device level. Leveraging mechanisms such as NEMS-based Physically Unclonable Functions (PUFs), shape memory materials, resonance-based fingerprints, and physical unlocking architectures, these systems offer enhanced resilience to reverse engineering, side-channel attacks, and environmental degradation. By harnessing mechanical unpredictability and fabrication-induced nanoscale variability, NEMS technologies introduce a physically robust and...

论文介绍 针对半导体制造与先进封装中日益严峻的硬件安全威胁，本文提出将纳米机电系统作为新型硬件安全原语。通过利用基于纳米机电系统的物理不可克隆函数、形状记忆材料及共振指纹等机制，该系统在设备层级实现物理保证、防篡改检测与身份认证，有效提升对逆向工程、侧信道攻击及环境退化的防御能力。

Query Cost Model Calibration in Confidential Virtual Machines

第一作者: Qihan Zhang · 方向: 软件安全

06/25 05:11

机密计算查询优化成本模型校准机密虚拟机隐藏英文摘要

With the growing adoption of Confidential Computing, running databases in confidential virtual machines (CVMs) such as AMD SEV-SNP has become an attractive way to protect sensitive cloud data with minimal changes to legacy DBMSs. However, analytical queries in such CVMs often suffer substantial overhead, and prior database work has largely stopped at benchmarking these slowdowns rather than optimizing them. We show that this problem stems from a hardware-software mismatch: query optimizers still rely on KVM-oriented (non-encrypted VM) cost assumptions that no longer hold in CVMs. To address this, we propose a lightweight CVM-aware cost calibration. It models two dominant sources of optimizer-facing overhead: data movement and RMP-related translation using simple physical proxies already available to the optimizer. Experiments show that the calibration significantly narrows the KVM/CVM...

论文介绍 针对机密虚拟机运行数据库的性能开销问题，本文指出其根源在于查询优化器仍依赖传统非加密虚拟机的成本假设。为此，提出一种轻量级机密虚拟机感知成本校准方法，利用物理代理对数据移动和内存转换开销进行建模。该方法有效缩小了性能评估差距，为机密计算环境下的数据库查询优化提供了重要支撑。

Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems

第一作者: Jakob Salfeld-Nebgen · 方向: 软件安全

06/25 02:43

AI治理自主代理机构证明高风险动作控制隐藏英文摘要

Autonomous AI agents may begin to perform consequential, irreversible actions such as clinical prescribing and production software deployment. This paper observes that human institutions have governed powerful autonomous actors not by monitoring their reasoning but by requiring independently attested evidence at the point of consequential action. We formalise this institutional pattern as a computational governance model for AI agent systems. Under the proposed model, an agent retains full autonomy over planning and reasoning but holds no execution authority over designated high-risk actions. Execution is conditional on preconditions that are each independently attested by a separate authoritative source, cryptographically bound to a declared intent, and evaluated by a deterministic policy. Decisions are recorded in a tamper-evident log amenable to independent re-verification. We...

论文介绍 针对自主AI系统执行高风险动作的治理难题，本文提出基于机构证明的计算治理模型。该模型允许AI代理保留规划自主权，但剥离其高风险动作的执行权。动作执行需满足由独立权威源加密绑定的先决条件，并由确定性策略评估。所有决策记录于防篡改日志以供复核，从而在保障自主性的同时实现安全管控。

The Role of Input Dimensionality in the Emergence and Targeted Control of Adversarial Examples

第一作者: Nasrin Malekzadeh Goradel · 方向: AI 安全

对抗样本输入维度高维几何深度学习安全隐藏英文摘要

Abstract:Several theoretical works have tried to explain the adversarial vulnerability of deep neural networks through properties of high-dimensional geometry. However, the assumptions underlying these works are rarely examined empirically, and systematic evidence remains limited. In this work, we present a systematic study of the role of input dimensionality in both the emergence and the targeted control of adversarial examples. We first analyse the scope and limitations of existing theoretical frameworks based on concentration of measure, showing that real image classes exhibit strong empirical localization, beyond what such theories typically assume. We then conduct an extensive empirical evaluation across hierarchical image datasets spanning a wide range of input dimensionalities and diverse neural architectures. Our results consistently show that adversarial examples become easier...

论文介绍 本文系统研究输入维度在对抗样本产生与定向控制中的作用。通过分析基于测度集中的理论框架，发现真实图像类具有强经验局部化特征。研究在涵盖多种输入维度与架构的图像数据集上进行广泛实证评估，揭示了输入维度与对抗样本易感性的内在联系，为理解和防御深度神经网络对抗漏洞提供了重要理论依据。

Federated Hash Projected Latent Factor Learning

第一作者: Jialan He · 方向: 软件安全

06/24 22:40

联邦学习哈希学习隐因子模型隐私保护隐藏英文摘要

Hash Learning (HL) is an efficient representation learning approach that maps real-valued data into compact binary representations. Traditional HL methods typically require users to upload personal data to a central server, which is incompatible with increasingly stringent data security regulations. Federated Learning (FL) provides a decentralized paradigm for learning globally optimal models without centralizing private data. However, most FL methods rely on transmitting large-scale real-valued gradient information, leading to high communication overhead and potential privacy risks. Integrating HL into FL is a promising solution. Nevertheless, existing HL methods suffer from limited representational capacity of binary codes, which may degrade model accuracy. To address this challenge, we propose a Federated Hash Projected Latent Factor (FHPLF) model. FHPLF introduces three key...

论文介绍 针对传统哈希学习需集中数据及联邦学习中实数梯度传输开销大、隐私风险高的问题，本文提出联邦哈希投影隐因子学习模型。该方法将哈希学习引入联邦范式，通过创新机制解决二进制码表示能力受限导致的精度下降挑战。它在避免数据集中的同时，有效降低通信开销，并提升全局模型的学习性能与隐私安全性。

Account-History Features for Social Bot Detection in the Era of Large Language Models

第一作者: Gaurang Katyal · 方向: 安全研究

社交机器人检测大语言模型账户历史特征随机森林隐藏英文摘要

Abstract:Bot detection on social platforms has historically relied on a mix of account-metadata features and features extracted from the text of posts and profile fields. The arrival of capable language models complicates the latter. A bot operator can run every post through GPT-4 or Claude and produce text whose surface statistics are difficult to distinguish from those of human writing, which weakens the predictive value of content-derived features. This paper asks how much of the detection problem can be solved by features that an attacker cannot easily manipulate at low cost: the age of the account, follower and friend counts and their ratios, profile completeness, and the structural properties of the handle. On a publicly redistributed corpus of 2,432 Twitter accounts with manually verified labels (43.0% bots), a random forest using only these account-history features achieves...

论文介绍 大语言模型使机器人能生成逼真文本逃避内容检测。本文提出仅依赖攻击者难以低成本操纵的账户历史特征进行检测，包括账户年龄、粉丝比例、资料完整度等。在公开数据集上的实证表明，仅使用这些特征的随机森林模型即可实现高效检测，为应对大模型时代的社交机器人威胁提供了低成本且鲁棒的方案。