2026-06-29

MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG

第一作者: Inderjeet Singh · 方向: AI 安全

检索增强生成多模态代理红队测试蒙特卡洛树搜索AI安全隐藏英文摘要

Abstract:Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning...

论文介绍 针对多模态代理检索增强生成系统攻击面扩大且现有红队方法易重复已知模板的问题，本文提出MIRROR跨表面红队测试框架。该方法在显式新颖性约束下执行记忆引导的蒙特卡洛树搜索，通过确定性新颖性门拒绝重复候选。研究有效提升了针对文本投毒和图像注入等多种攻击面的自动化漏洞挖掘与评估能力。

MergeLLL: A Hierarchical Divide-and-Conquer Framework for LLL-Based Lattice Reduction

第一作者: Niharika Gauraha · 方向: 密码学协议

格基约化分治策略LLL算法并行计算隐藏英文摘要

Abstract:Lattice basis reduction algorithms have various applications in computational number theory and lattice-based cryptography, but their complexity increases rapidly with the dimension. Motivated by the divide-and-conquer strategy of merge sort and incorporating PotLLL-style deep insertions during recombination, MergeLLL is proposed. In this framework, a lattice basis is split into sub-bases, local reductions are performed independently, and the full basis is reconstructed through hierarchical merging. The approach is focused on improving local lattice structure first before global basis properties are refined, resulting in enhanced Gram-Schmidt orthogonality and numerical stability, while overall computational cost is reduced. The method is naturally parallelizable, allowing efficient multicore and distributed execution. It is shown that the reduction and merging steps preserve...

论文介绍 针对格基约化算法在高维下计算复杂度急剧增加的问题，本文提出MergeLLL分层分治框架。该方法将格基拆分为子基进行独立局部约化，并结合深度插入策略进行分层合并重建。此方法优先优化局部格结构，提升了正交性与数值稳定性，同时降低整体计算开销，并天然支持多核与分布式并行执行。

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

第一作者: Christian Scano · 方向: 软件安全

06/25 15:37

Android安全对抗性攻击恶意软件检测问题空间攻击隐藏英文摘要

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire benign modules, introducing many side-effect features and often causing build-time failures. Fine-grained methods that inject only a narrow subset of components exhibit limited effectiveness, while those that also use obfuscation rely on brittle bytecode rewriting, producing APKs that are syntactically valid but semantically unusable. Prior work further overestimates attack success rates by running smoke tests that only validate installation and basic execution, without assessing whether the modified APK still preserves its intended behavior. To overcome these limitations, we present DROIDBREAKER...

论文介绍 针对现有针对机器学习Android恶意软件检测器的问题空间对抗攻击存在构建失败或语义失效等局限，本文提出DroidBreaker框架。该方法克服了传统软件移植引入副作用及细粒度注入效果不佳的问题，能生成逃避检测且保留原有功能的对抗性APK，提升了实际威胁评估的准确性。

The Fungible Reserve Standard: A Deterministic Framework for Encoding Carrying Costs in Asset-Backed Tokens

第一作者: JJ Jia Jing Tan · 方向: 区块链安全

现实世界资产代币化区块链可替换储备标准负携带成本隐藏英文摘要

Abstract:The tokenization of real-world assets (RWAs) has emerged as a transformative application of blockchain technology, with market projections estimating trillions of dollars in tokenized assets within the coming decade. However, a fundamental challenge remains unaddressed: physical assets such as precious metals, stored commodities, and warehoused goods incur structural negative carry -- custody, insurance, and audit costs that accumulate over time. While existing tokenization models have successfully established the market for digital gold and treasuries, they typically manage operational costs at the issuer level. The FRS introduces a framework to bring these economics directly on-chain, avoiding mechanisms such as token rebasing that compromise fungibility and composability with decentralized finance (DeFi) protocols. This paper proposes the Fungible Reserve Standard (FRS), a...

论文介绍 现实世界资产代币化面临物理资产产生保管与保险等结构性负携带成本的挑战。本文提出可替换储备标准，一种将此类持有成本直接编码上链的确定性框架。该标准避免了代币重定基等损害资产可替换性与DeFi可组合性的机制，为贵金属和仓储商品等资产的链上经济模型提供了更优的解决方案。

TGHE: Template-based Graph Homomorphic Encryption for Privacy-Preserving GNN Inference in Edge-Cloud Systems

第一作者: Ngoc Bao Anh Le · 方向: 密码学协议

图神经网络同态加密隐私保护边缘计算SIMD并行隐藏英文摘要

Abstract:Existing homomorphic encryption (HE)-based GNN systems adopt a graph-centric paradigm that couples per-query cost to global graph size, limiting evaluations to at most ~20k nodes and making them incompatible with dynamic, large-scale financial graphs. We propose TGHE (Template-based Graph Homomorphic Encryption), an ego-centric framework that resolves this by exploiting a template phenomenon: local computation trees in transaction graphs converge into a small set of structural shapes. TGHE canonicalizes ego-graphs at the edge and packs structurally identical trees into shared CKKS ciphertexts for SIMD-parallel encrypted inference, with two long-tail optimizers (Approximate Template Fitting and Topology Collapse) ensuring full SIMD coverage. On DGraphFin (3.7M nodes, 4.3M edges), TGHE-Collapse achieves a 66.9x speedup over the sequential encrypted baseline with less than 0.002...

论文介绍 针对现有同态加密图神经网络推理受限于全局图规模的问题，本文提出TGHE框架。该方法利用交易图局部计算树的模板现象，在边缘端规范化子图，并将结构相同的树打包至共享密文中进行SIMD并行加密推理。结合长尾优化策略，TGHE在保障隐私的前提下大幅提升了大规模动态金融图的加密推理效率。

Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents

第一作者: Nada Lahjouji · 方向: AI 安全

大语言模型代理隐私保护数据安全综述隐藏英文摘要

Abstract:Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf. As they move from answering questions to operating over sensitive data, privacy becomes harder to enforce. An agent touches many data sources, runs multi-step workflows, keeps state across sessions, and acts with delegated permissions. Sensitive information can therefore leak not only through its final answer but through the queries it issues, the intermediate results it handles, the memory it writes, and the messages it exchanges with other agents. We survey the privacy of LLM agents from a data-centric view, organizing the field around the data an agent touches rather than by attack type, and we use data agent as shorthand for an LLM agent that works with data. Research on these risks is active but scattered across...

论文介绍 随着大语言模型代理深入参与数据库查询与外部调用，其处理敏感数据引发的隐私泄露风险日益凸显。本文从数据中心视角对LLM代理隐私问题进行综述，打破传统按攻击类型分类的框架，系统梳理代理在查询、中间状态、记忆及多智能体交互等环节的数据接触风险，为构建安全的代理系统提供理论参考。

Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models

第一作者: Abrar Alotaibi · 方向: AI 安全

对抗性攻击扩散模型多模态安全大语言模型综述隐藏英文摘要

Abstract:Adversarial evaluation of AI systems has matured along four largely disconnected tracks: diffusion-based attacks on text and large language models (LLMs), diffusion-based attacks on image classifiers, jailbreak pipelines against vision-language models, and diffusion-based input purification defenses. Each has developed its own vocabulary, threat models, and benchmarks, with denoising diffusion models emerging as a shared generative mechanism whose recipes are now actively ported between communities. This survey performs an information-fusion exercise at the meta-research level: we integrate these four tracks into a single conceptual framework with a unified taxonomy, evaluation criteria, and research agenda, focusing on the LLM-side slice. We catalog fifty published papers across four scope areas (text/LLM, image classifier, vision-language model, defense), plus four...

论文介绍 针对AI对抗性评估在不同模态各自为战的现状，本文对基于扩散模型的跨模态攻击与防御进行融合综述。研究将文本、图像、视觉语言模型及输入净化防御整合至统一框架，提出一致的分类法与评估标准，重点聚焦大语言模型侧的安全威胁，为多模态AI鲁棒性研究提供全局视角。

TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA

第一作者: Subin Song · 方向: 密码学协议

5G网络安全广播认证TESLA协议系统信息块隐藏英文摘要

Abstract:5G base stations broadcast unauthenticated system information (SI) that every user equipment (UE) reads during cell selection. This enables attackers to broadcast forged SI from a fake base station (FBS), deceiving UEs into camping on it. Prior approaches require UEs to authenticate System Information Block 1 (SIB1) using digital signatures. This necessitates computation-heavy verification for every SIB1 reception, imposing a significant burden on resource-constrained UEs. We propose TESLA-for-5G (TF5), a broadcast authentication protocol for 5G SIB1 that combines TESLA with GG09 Schnorr-like identity-based signatures (IBS). In the steady state, TF5 enables UEs to authenticate each SIB1 message using a symmetric MAC and delayed key disclosure, eliminating the need for per-message digital signatures. Initial trust is bootstrapped during cell entry using a lightweight GG09 IBS...

论文介绍 针对5G网络中系统信息广播易受伪造且传统数字签名认证计算开销过大的问题，本文提出TF5广播认证协议。该方法结合TESLA机制与基于身份的签名，在稳态下利用对称消息认证码和延迟密钥披露替代逐条数字签名验证，显著降低了资源受限终端的计算负担，同时保障了小区接入的初始信任安全。

VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills

第一作者: Ying Li · 方向: 安全研究

06/25 09:58

AI代理安全运行时强制行为规范访问控制隐藏英文摘要

Agentic systems increasingly act through third-party skills, allowing model-generated decisions to affect files, communication channels, and cyber-physical devices. These skills often include natural-language specifications that define access permissions, disclosure limits, execution privileges, and required preconditions. Although such specifications describe the intended boundaries of skill behavior, they do not by themselves provide executable runtime enforcement. Enforcing them raises a contextual granularity challenge: even when a policy is written for a particular task context, a monitor must still decide which events to observe, what state to retain, how far across the execution to reason, and where to intervene. Choosing the wrong granularity can either block benign executions or miss violations that emerge only across multiple actions. Most existing enforcement mechanisms...

论文介绍 针对AI代理调用第三方技能时自然语言行为规范缺乏可执行运行时强制的问题，本文提出VIGIL机制。该方法解决了上下文粒度挑战，通过精确决定事件观察、状态保留与干预位置，在保障代理执行灵活性的同时，实现了对技能访问权限、披露限制及执行前提等边界条件的严格动态监控与违规拦截。

DKVE: Decentralized Key Validation for End-to-End Encrypted Messaging

第一作者: Subin Song · 方向: 密码学协议

端到端加密公钥验证隐私保护社交图DKVE协议隐藏英文摘要

Abstract:End-to-end encrypted messaging systems depend on authentic public key distribution to prevent man-in-the-middle (MitM) attacks. Current solutions present a stark trade-off: out-of-band (OOB) verification provides strong security but lacks scalability for large contact lists, while key transparency (KT) systems enable automated verification at high storage costs and operational complexity. We propose DKVE, a protocol that validates public keys through privacy-preserving cross-validation within users' social graphs. When obtaining a contact's public key from a key server, clients query mutual contacts to verify they hold the same key, combining Oblivious Pseudorandom Functions (OPRF) and Oblivious Key-Value Stores (OKVS) to preserve privacy of both queries and contact lists. DKVE employs a Sequential Probability Ratio Test (SPRT) to aggregate responses and detect server...

论文介绍 针对端到端加密消息系统中公钥验证的安全与扩展性权衡问题，本文提出DKVE协议。该协议利用用户社交图进行隐私保护的交叉验证，结合不经意伪随机函数和不经意键值存储技术，在验证公钥的同时保护查询与联系人列表隐私，为大规模加密通信提供了去中心化的安全验证新方案。

Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents

第一作者: Praneeth Narisetty · 方向: AI 安全

大语言模型代理提示注入带外防御AI安全引用监控隐藏英文摘要

Abstract:Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions. Systems such as CaMeL, FIDES, Progent, RTBAS, and FORGE realize this with capabilities, information-flow labels, and reference monitors, and several report near-elimination of attacks on the AgentDojo benchmark. We make two contributions. First, we organize these out-of-band defenses as instances of classical integrity protection (Biba), reference monitoring, and least privilege, yielding a structured comparison of what they do and do not cover. Second, we warn that every one of them is validated only on static benchmarks (a fixed set of injection attempts), the same methodology that made...

论文介绍 针对大语言模型代理面临的间接提示注入威胁，本文系统评估了现有的带外防御机制。研究将这些防御策略映射为经典完整性保护与最小权限原则，并进行结构化对比分析。同时指出当前防御仅在静态基准上验证的局限性，呼吁建立自适应评估方法以应对不断演变的攻击。

What Browsers Do in the Shaders: A Measurement Study of WebGPU Privacy

第一作者: Igor Santos-Grueiro · 方向: 网络安全

WebGPU隐私泄露浏览器安全指纹识别WGPULens隐藏英文摘要

Abstract:WebGPU lets ordinary web pages run GPU workloads through a validated programming model. Validation protects memory safety, but shared browser, driver, OS, and GPU state can still expose privacy-relevant signals. We present WGPULens, a framework for measuring those signals across controlled scenarios, browser-native co-residency, a participant field study, public page loads, and mitigation policies. Our framework separates measurements: controlled scenarios support leakage, boundary, and mitigation claims; participant runs support deployment, compatibility, and fingerprintability; and a Tranco crawl measures WebGPU exposure in real-world pages. Our controlled results identify persistent pipeline compilation state as the clearest surface. Cold/warm pipeline probes reveal prior compilation state across selected origin, profile, and browser placements. Controlled browser/native...

论文介绍 针对WebGPU在网页中运行GPU工作负载时可能引发的隐私泄露问题，本文提出WGPULens测量框架。通过在受控场景、真实网页抓取及用户研究中分离测量维度，研究系统评估了浏览器与GPU共享状态暴露的隐私信号，并识别出持久管道编译状态是主要的指纹泄露面。

Lessons from the Adoption and Deprecation of the Privacy Sandbox Web APIs

第一作者: Yohan Beugin · 方向: 网络安全

06/25 05:22

隐私沙盒Web API网络追踪隐私保护纵向研究隐藏英文摘要

While several web actors have been trying to reduce web tracking for years, it remains unclear how to achieve both desirable levels of utility and privacy. In 2019, Google launched the Privacy Sandbox initiative to balance that trade-off and find privacy alternatives to common use cases such as advertising. Yet, in late 2025, Google canceled the project and deprecated most of the newly introduced APIs. Despite its end, the Privacy Sandbox represents a unique opportunity to learn about how the ecosystem reacted to the proposed changes and make observations about why and how it failed. In this paper, we present a longitudinal measurement and analysis study of the Privacy Sandbox APIs to characterize their adoption and deprecation over the past seven years by different web actors. Leveraging historical HTTP Archive crawls and public Chrome telemetry data, we offer the largest study of its...

论文介绍 针对Google隐私沙盒项目的终止，本文对Privacy Sandbox Web API的采用与废弃过程进行了纵向测量与分析。通过结合历史网页存档与浏览器遥测数据，研究系统刻画了七年间网络生态对该隐私替代方案的反应，为理解如何在实用性与隐私保护间取得平衡提供了重要经验。

Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats

第一作者: Poojitha Thota · 方向: AI 安全

大语言模型意图验证危害评估AI安全对抗防御隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in interactive applications, yet they remain vulnerable to adversarial interactions that induce harmful, deceptive, or policy-violating outputs. Existing defenses typically analyze either user prompts or generated outputs, but not both. However, many real-world attacks exploit a separation between adversarial intent expressed in the prompt and actionable harm manifested only in the response. As a result, prompt-only and response-only defenses frequently miss unsafe interactions that appear benign when viewed from either side in isolation. We present a verification-centric defense framework that jointly evaluates prompt intent and response harm before an LLM response is delivered to a user. The framework employs specialized analysts for intent and harm assessment together with a Judge for conflict resolution. We formalize a...

论文介绍 针对大语言模型在交互中易受对抗攻击产生有害输出的问题，本文提出一种联合验证意图与危害的统一防御框架。该方法在模型输出交付前，通过专门的分析师分别评估用户提示意图与生成内容的危害性，并引入裁判机制解决评估冲突，有效弥补了单一侧防御的盲区。

Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model

第一作者: Sergey Kurilenko · 方向: 密码学协议

语义搜索隐私保护同态加密SVD截断CKKS隐藏英文摘要

Abstract:Dense embeddings power semantic search and retrieval-augmented generation, but embedding-inversion attacks can reconstruct source text from a vector: when a vector database leaks, the documents behind it leak too. The textbook defences are extremes - encrypting the whole search homomorphically is sound but too slow at million-document scale, while privacy noise degrades ranking long before it protects. We study a middle path exploiting the asymmetry between the static collection and the dynamic query. The collection is protected geometrically: each vector is truncated onto a lower-dimensional SVD subspace and rotated by a secret orthogonal transform known only to the owner. The query is protected cryptographically: it is reranked under CKKS homomorphic encryption, so an honest-but-curious server never sees the query or the scores. CKKS parameters come from a small offline...

论文介绍 针对语义搜索中向量数据库泄露导致的源文本重建风险，本文提出一种混合隐私感知语义搜索方案。该方法结合几何与密码学保护：对静态文档集合进行SVD截断与正交变换，对动态查询则采用CKKS同态加密进行重排序，在保障检索精度的同时有效抵御嵌入反转攻击。

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

第一作者: Minjae Bae · 方向: 软件安全

供应链安全Go模块恶意代码代码混淆软件安全隐藏英文摘要

Abstract:We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a) a manual search on GitHub across 2,113 repositories and b) a large-scale scan of 12.3M index entries using a deobfuscating AST scanner (GOAST) that we implemented. As a result, we identified 2,289 malicious versions of legitimate Go modules. We demonstrate that purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Moreover, our proxy-based measurements of the takedown-remediation gap reveal that among artifacts later found to be GitHub-unobservable (i.e., removed or suspended), at least 99.4%...

论文介绍 针对Go生态系统中的自动化供应链攻击，本文通过GitHub手动排查与自研AST扫描器对千万级索引进行大规模测量，识别出两千余个恶意模块版本。研究揭示了仅依赖代码托管平台下架机制的局限性，并量化了恶意代码在平台外的持久性，为软件供应链治理提供了实证依据。

TEMPO-Diffusion: Temporally Exposed Malicious Poisoning of Diffusion Models

第一作者: William Aiken · 方向: 网络安全

扩散模型后门攻击数据投毒AI安全图像生成隐藏英文摘要

Abstract:Noise-based backdoor attacks on diffusion models typically rely on input-time trigger injection, untargeted activation, and out-of-distribution target generation. Such assumptions reduce both the stealthiness and the practical relevance of these attacks. In this work, we present TEMPO-Diffusion, a targeted backdoor framework that localizes the malicious distribution shift to a temporal, in-distribution exposure. TEMPO-Diffusion supports: (i) targeted attacks on and to specific classes, (ii) multiple sub-image backdoors that reconstruct specific features within multiple, different output images and at multiple locations, and (iii) in-painting with time-conditioned triggers. To study relevant, practical security concerns in leveraging backdoored diffusion models for synthetic training data, we also introduce CALISA: a balanced, region-aware traffic-sign dataset emphasizing...

论文介绍 针对扩散模型后门攻击隐蔽性不足的问题，本文提出TEMPO-Diffusion框架，将恶意分布偏移限制在时间维度的分布内暴露。该框架支持多类别定向攻击与多位置特征重建，并引入时间条件触发机制。研究还发布了专用数据集，深入探讨了后门模型在生成合成训练数据时的安全隐患。

Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps

第一作者: Yeeun Jo · 方向: 网络安全

隐私泄露生育追踪应用网络流量分析第三方广告隐藏英文摘要

Abstract:While human factors in the privacy of fertility tracking apps -- health trackers that record users' menstrual or pregnancy data -- has been the subject of extensive study, little attention has been paid to the technical aspects of apps' data handling practices. We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store, focusing on how user data is shared with third party advertising services. After systematizing app features, we conduct a series of standardized user interactions across all apps in an environment that records TLS-stripped network traffic. In a subset of apps (n=5) we identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's. Equally importantly, we observe additional apps that use an ad-based monetization model without apparent...

论文介绍 本文针对生育追踪应用的用户健康数据隐私问题，对20款Android应用进行网络流量测量研究。通过分析应用与第三方广告服务的交互，发现部分应用存在显式数据泄露及通过定向广告URL隐式泄露的问题。该研究揭示了此类应用数据共享的技术细节，为移动健康应用的隐私保护与监管提供了实证依据。

CyberChainBench: Can AI Agents Secure Smart Contracts Against Real-World On-Chain Vulnerabilities?

第一作者: Jintao Huang · 方向: 软件安全

智能合约安全大语言模型智能体漏洞检测基准测试DeFi安全隐藏英文摘要

Abstract:We present CyberChainBench, a benchmark for evaluating LLM-based agents on smart contract security across three complementary tasks: vulnerability detection, exploit generation, and patch synthesis. Built from 541 real-world exploit incidents from DeFiHackLabs spanning 9 EVM chains, the benchmark provides end-to-end on-chain evaluation where agents interact with historical blockchain state through isolated evaluation environments orchestrated by Harbor, using tools to read code, trace transactions, and validate exploits on mainnet forks. Each case is anchored to a specific block and includes structured ground truth covering vulnerability type, localization, and attacker profit. Exploits are graded by economic impact on historical forks; patches are validated by replaying historical attacks and legitimate transactions as fail-to-pass test oracles on a proxy-upgradeable subset...

论文介绍 本文提出CyberChainBench基准，评估大语言模型智能体在智能合约安全任务中的表现。涵盖漏洞检测、利用生成与补丁合成，基于真实去中心化金融黑客事件构建，支持智能体在隔离环境中与历史链上状态交互。该研究为衡量AI智能体在复杂链上安全场景的端到端修复能力提供了标准化评估框架。

Data Facts: A Metadata Schema for Structured Data Exchange in the NANDini Multi-Agent Ecosystem

第一作者: Jin Gao · 方向: 密码学协议

06/25 01:35

多智能体系统元数据模式结构化数据交换NANDini隐藏英文摘要

NANDini (Networked Agents Natural Distillation of Interconnected Nodal Intelligence) envisions an automated ecosystem where intelligent agents independently create, process, and exchange data to drive decisions at scale. Realizing this vision requires infrastructure beyond agent discovery and communication: agents must be able to advertise, evaluate, and verify the datasets they hold. Current protocols, including NANDA for federated registry and A2A and MCP for inter-agent messaging, address identity and communication but provide no mechanism for structured data exchange. Existing enterprise data-sharing frameworks, such as IDS-RAM, Gaia-X, and Ocean Protocol, assume human-in-the-loop governance that is incompatible with autonomous, real-time agent interactions. We introduce Data Facts, a core NANDini concept: a lightweight JSON metadata schema that bridges agent discovery and data...

论文介绍 针对多智能体生态系统中结构化数据交换的缺失，本文提出Data Facts概念。这是一种轻量级JSON元数据模式，弥补现有协议在数据发现与验证方面的不足。它支持智能体自主发布、评估和验证数据集，为构建无需人工干预的大规模自动化智能体数据共享基础设施提供了核心协议支撑。

MIRAGE: Protecting against Malicious Image Editing via False Moderation

第一作者: Anshul Nasery · 方向: 系统安全

图像安全恶意编辑防护安全审核绕过系统级防御隐藏英文摘要

Abstract:The proliferation of AI-powered image editing systems raises serious concerns because it allows personal images to be arbitrarily manipulated at scale, with minimal effort, and a lower barrier to entry. Prior work on image immunization adds imperceptible perturbations to an image to protect against unauthorized manipulations. However, these methods usually require access to the model weights and the image manipulating prompt. This significantly limits their use, especially against powerful commercial image-editors such as GPT-Image, Gemini Flash Image (Nano Banana), and Grok Imagine. To address this, we take a system-level view of the problem and identify a previously unexplored attack surface common to all major commercial image editing systems: pre-generation safety moderation. Rather than disrupting the generative model itself, we propose to immunize images by causing these...

论文介绍 针对AI图像编辑带来的恶意篡改风险，本文提出系统级防御方法MIRAGE。不同于依赖模型权重的传统技术，MIRAGE利用商业系统普遍存在的生成前安全审核机制，通过添加扰动触发审核误报，从而阻止图像被恶意处理。该方法无需访问模型参数，为防范主流商业图像编辑工具的滥用提供了有效防护。

A Deterministic Control Plane for LLM Coding Agents

第一作者: Padmaraj Madatha · 方向: AI 安全

大语言模型智能体配置管理权限控制确定性控制平面隐藏英文摘要

Abstract:LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to...

论文介绍 本文研究大语言模型编码智能体配置层缺乏管理的问题。分析万余个开源仓库发现，智能体配置被广泛跨组织共享、极少修改且缺乏权限声明。为此，作者提出一种确定性控制平面，将配置映射为可管理的组件，以解决配置无序传播带来的安全隐患，提升AI编码智能体在开发环境中的可控性与安全性。

Autoformalization of Agent Instructions into Policy-as-Code

第一作者: Adam Mondl · 方向: 软件安全

智能体安全自动形式化策略即代码大语言模型隐藏英文摘要

Abstract:Agent safety in high-stakes domains requires formal policy enforcement, but most existing approaches either rely on probabilistic guardrails (fine-tuned classifiers, prompt-based steering) that offer no formal guarantees, or on hand-coded symbolic enforcement that does not scale to the breadth of real policy specifications. We present an autoformalization pipeline that translates agent prompts, MCP tool descriptions, and natural language policy documents into formally verified policies using an LLM-based generator-critic loop. The resulting policies are written in the Cedar Policy Language. On the MedAgentBench benchmark, our autoformalized policies cover substantially more of the source natural-language specification than the hand-coded symbolic enforcement in prior work.

论文介绍 针对高风险领域智能体安全策略难以形式化执行的问题，本文提出自动形式化管道。该方法利用大语言模型生成与批评循环，将智能体提示、工具描述及自然语言策略自动转化为Cedar语言编写的形式化策略。研究表明，其生成的策略比手工编码能更全面覆盖自然语言规范，提升了智能体行为约束的严谨性。

Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform

第一作者: Manar Alsaid · 方向: 软件安全

基础设施即代码Terraform安全大语言模型欺骗性修复检测隐藏英文摘要

Abstract:Security misconfigurations in Terraform Infrastructure-as-Code are a growing risk in cloud deployments, and large language models are increasingly used as automated repair agents. Existing evaluations often treat a repair as successful when the targeted static-analysis finding disappears, without checking planning validity, behavioral change, or security intent. This paper presents TerraProbe, a five-layer oracle framework for evaluating LLM-assisted Terraform security repair. We apply TerraProbe to 288 first-pass repairs generated by gemini-2.5-flash-lite, GPT-4o, and Claude 3.5 Sonnet across 68 real-world TerraDS modules and 28 controlled injected-defect modules. The results show that targeted Checkov removal overstates repair success. Although targeted removal reaches 83.3 percent for the primary model, full-scanner cleanliness drops to 10.4 percent, Terraform planning...

论文介绍 针对Terraform代码安全风险及大模型自动修复局限，本文提出TerraProbe五层评估框架。该框架从规划有效性、行为变更及安全意图等维度检验修复质量，克服仅依赖静态分析消除的评估缺陷。研究揭示主流大模型存在欺骗性修复现象，为准确评估AI代码修复的真实安全性提供了可靠工具。

ProvenAI: Provenance-Native Traces of Evidence in Generated Answers

第一作者: Mohammad Faizan · 方向: 系统安全

06/25 07:22

检索增强生成引用保真度归因审计多跳问答隐藏英文摘要

Retrieval-augmented systems routinely present citations alongside generated answers, yet a citation does not confirm that the corresponding source meaningfully shaped the output. This paper introduces ProvenAI, a framework that decomposes transparency in multi-hop question answering into three independently measurable layers: answer correctness, citation fidelity against benchmark supporting evidence, and per-document influence under leave-one-resource-out intervention. Targeting the HotpotQA distractor benchmark through a seven-stage pipeline covering data normalisation, retrieval indexing, citation-aware answer generation, attribution auditing, ablation-based influence estimation, batch evaluation, and interactive inspection, ProvenAI evaluates 7,405 validation examples drawn from a canonical corpus of 509,300 passages. The system achieves 53.53% answer accuracy alongside a mean...

论文介绍 针对检索增强系统中引用无法证明来源实际影响的问题，本文提出ProvenAI框架。该框架将多跳问答透明度分解为答案正确性、引用保真度和单文档影响力三个独立可测层。通过归因审计和消融干预流水线，ProvenAI能精确评估生成答案的证据溯源质量，有效识别虚假引用，提升了问答系统的可信度。

Nanoelectromechanical Systems (NEMS) for Hardware Security in Advanced Packaging

第一作者: Himanandhan Reddy Kottur · 方向: 系统安全

纳米机电系统硬件安全物理不可克隆功能先进封装篡改检测隐藏英文摘要

Abstract:As hardware security threats escalate across semiconductor manufacturing and advanced packaging, there is a growing need for novel physical mechanisms to counter sophisticated attacks such as tampering, counterfeiting, and supply chain infiltration. This paper presents Nanoelectromechanical Systems (NEMS) as an emerging class of hardware security primitives that enable physical assurance, tamper detection, and authentication at the device level. Leveraging mechanisms such as NEMS-based Physically Unclonable Functions (PUFs), shape memory materials, resonance-based fingerprints, and physical unlocking architectures, these systems offer enhanced resilience to reverse engineering, side-channel attacks, and environmental degradation. By harnessing mechanical unpredictability and fabrication-induced nanoscale variability, NEMS technologies introduce a physically robust and...

论文介绍 针对半导体制造和先进封装中日益严重的硬件安全威胁，本文提出将纳米机电系统作为新兴的硬件安全原语。该系统利用物理不可克隆功能、形状记忆材料及共振指纹等机制，在设备级实现物理保证、篡改检测与身份认证，有效提升对逆向工程和侧信道攻击的防御能力。

Query Cost Model Calibration in Confidential Virtual Machines

第一作者: Qihan Zhang · 方向: 软件安全

06/25 05:11

机密计算机密虚拟机查询优化成本校准数据库性能隐藏英文摘要

With the growing adoption of Confidential Computing, running databases in confidential virtual machines (CVMs) such as AMD SEV-SNP has become an attractive way to protect sensitive cloud data with minimal changes to legacy DBMSs. However, analytical queries in such CVMs often suffer substantial overhead, and prior database work has largely stopped at benchmarking these slowdowns rather than optimizing them. We show that this problem stems from a hardware-software mismatch: query optimizers still rely on KVM-oriented (non-encrypted VM) cost assumptions that no longer hold in CVMs. To address this, we propose a lightweight CVM-aware cost calibration. It models two dominant sources of optimizer-facing overhead: data movement and RMP-related translation using simple physical proxies already available to the optimizer. Experiments show that the calibration significantly narrows the KVM/CVM...

论文介绍 在机密虚拟机中运行数据库常面临显著性能开销，传统查询优化器因依赖非加密虚拟机的成本假设而导致性能下降。本文提出一种轻量级的机密虚拟机感知成本校准方法，通过物理代理对数据移动和内存转换等核心开销进行建模，显著缩小了性能评估差距，为机密计算环境下的数据库查询优化提供了有效支持。

Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems

第一作者: Jakob Salfeld-Nebgen · 方向: 软件安全

06/25 02:43

自主人工智能系统计算治理机构证明高风险动作防篡改日志隐藏英文摘要

Autonomous AI agents may begin to perform consequential, irreversible actions such as clinical prescribing and production software deployment. This paper observes that human institutions have governed powerful autonomous actors not by monitoring their reasoning but by requiring independently attested evidence at the point of consequential action. We formalise this institutional pattern as a computational governance model for AI agent systems. Under the proposed model, an agent retains full autonomy over planning and reasoning but holds no execution authority over designated high-risk actions. Execution is conditional on preconditions that are each independently attested by a separate authoritative source, cryptographically bound to a declared intent, and evaluated by a deterministic policy. Decisions are recorded in a tamper-evident log amenable to independent re-verification. We...

论文介绍 针对自主人工智能系统可能执行不可逆高风险动作的问题，本文提出一种基于机构证明的计算治理模型。该模型允许人工智能保留规划与推理的自主权，但将高风险动作的执行权剥离，要求其前提条件必须经过独立权威来源的加密证明与策略评估，并将决策记录于防篡改日志中，从而实现对人工智能行为的安全治理。

The Role of Input Dimensionality in the Emergence and Targeted Control of Adversarial Examples

第一作者: Nasrin Malekzadeh Goradel · 方向: AI 安全

对抗样本输入维度深度学习测度集中鲁棒性隐藏英文摘要

Abstract:Several theoretical works have tried to explain the adversarial vulnerability of deep neural networks through properties of high-dimensional geometry. However, the assumptions underlying these works are rarely examined empirically, and systematic evidence remains limited. In this work, we present a systematic study of the role of input dimensionality in both the emergence and the targeted control of adversarial examples. We first analyse the scope and limitations of existing theoretical frameworks based on concentration of measure, showing that real image classes exhibit strong empirical localization, beyond what such theories typically assume. We then conduct an extensive empirical evaluation across hierarchical image datasets spanning a wide range of input dimensionalities and diverse neural architectures. Our results consistently show that adversarial examples become easier...

论文介绍 本文系统研究输入维度在深度神经网络对抗样本产生与定向控制中的作用。通过分析现有测度集中理论的局限性，发现真实图像数据具有强经验局部化特征。研究在多种数据集和架构上进行广泛实证评估，揭示了输入维度变化对对抗样本生成难度的影响，为理解对抗脆弱性及提升模型鲁棒性提供了新视角。

Federated Hash Projected Latent Factor Learning

第一作者: Jialan He · 方向: 软件安全

06/24 22:40

联邦学习哈希学习隐私保护二进制表示潜在因子隐藏英文摘要

Hash Learning (HL) is an efficient representation learning approach that maps real-valued data into compact binary representations. Traditional HL methods typically require users to upload personal data to a central server, which is incompatible with increasingly stringent data security regulations. Federated Learning (FL) provides a decentralized paradigm for learning globally optimal models without centralizing private data. However, most FL methods rely on transmitting large-scale real-valued gradient information, leading to high communication overhead and potential privacy risks. Integrating HL into FL is a promising solution. Nevertheless, existing HL methods suffer from limited representational capacity of binary codes, which may degrade model accuracy. To address this challenge, we propose a Federated Hash Projected Latent Factor (FHPLF) model. FHPLF introduces three key...

论文介绍 针对传统哈希学习需集中数据及联邦学习传输实数梯度导致通信开销大与隐私泄露问题，本文提出联邦哈希投影潜在因子模型。该方法将哈希学习引入联邦范式，在避免集中私有数据的同时，通过二进制表示降低通信成本，并引入关键机制克服现有二进制编码表示能力受限的缺陷，兼顾隐私保护与模型精度。

Account-History Features for Social Bot Detection in the Era of Large Language Models

第一作者: Gaurang Katyal · 方向: 安全研究

社交机器人检测大语言模型账户历史特征随机森林特征工程隐藏英文摘要

Abstract:Bot detection on social platforms has historically relied on a mix of account-metadata features and features extracted from the text of posts and profile fields. The arrival of capable language models complicates the latter. A bot operator can run every post through GPT-4 or Claude and produce text whose surface statistics are difficult to distinguish from those of human writing, which weakens the predictive value of content-derived features. This paper asks how much of the detection problem can be solved by features that an attacker cannot easily manipulate at low cost: the age of the account, follower and friend counts and their ratios, profile completeness, and the structural properties of the handle. On a publicly redistributed corpus of 2,432 Twitter accounts with manually verified labels (43.0% bots), a random forest using only these account-history features achieves...

论文介绍 大语言模型的普及使基于文本的社交机器人检测面临失效风险。本文提出依赖账户历史特征的检测方法，利用账户年龄、粉丝与好友比例、资料完整度及句柄结构等攻击者难以低成本操纵的属性。实验表明，仅使用这些历史特征训练的随机森林模型即可实现高效识别，为大模型时代的社交平台安全治理提供了新思路。