2026-06-30

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

第一作者: Yanchen Yin · 方向: AI 安全

隐藏英文摘要

Abstract:Jailbreak attacks bypass LLM safety alignment, yet their mechanisms remain poorly understood. We provide evidence that attacks do not comprehensively eliminate safety features, but instead selectively suppress specific attention heads. We identify two functionally differentiated types: Adversarially Compromised Heads (ACHs) concentrated in early layers, which are suppressed under attacks, and Safety-Aligned Heads (SAHs) in mid-layers, which maintain robust activations even when attacks succeed. Ablation studies support the causal role of ACHs and the contribution of SAHs to robust activations: suppressing a small number of ACHs is sufficient to induce jailbreak-like behavior on normally refused inputs, while removing SAHs substantially weakens mid-layer safety activations. Token-level attribution further shows that ACH suppression is driven specifically by attack-template...

GTI-mSEMP Framework : A Proposed Framework to Stimulate Malware Propagation with Inclusion of Attacker-Defender Strategy

第一作者: Shadeeb Hossain · 方向: 网络安全

隐藏英文摘要

Abstract:The rapid proliferation of automated, multi-vector malware threats poses a significant risk to heterogeneous, resource constrained cyber-physical networks. Conventional epidemiological models often treat security defenses as static parameters, failing to capture the strategic, asymmetric maneuvers between an attacker and a defender. To address the gap, this paper proposes a Game-Theory-Integrated Modified Multi- Wireless Sensor Epidemic Malware Propagation (GTI-mSEMP) framework. This paper analyzed and compared the operational trajectories of Susceptible (S) and Recovered (R) node populations across three different operational regimes: Balanced Matchup, Exploit Surge and Hardened Defense. Numerical simulation results capture the real-time transient dynamics of the network state variables, demonstrating how the epidemic curve shifts when either the defensive or offensive...

ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents

第一作者: Shijing Hu · 方向: AI 安全

隐藏英文摘要

Abstract:Large language models (LLMs) have increasingly moved from standalone text generation systems to agents that invoke external tools, access environments, and execute multi-step tasks. However, conventional function-calling benchmarks mainly evaluate task completion and API correctness, while privacy evaluation benchmarks typically focus on final responses or privacy judgments. Neither perspective captures purpose-bound information flow across an executed multi-tool trajectory. Motivated by this limitation in current agent evaluation, ToolPrivacyBench audits whether task-private atoms are routed only to authorized tools and downstream sinks, thereby evaluating both task completion and privacy over-disclosure during tool use. The benchmark contains 2,150 cases, including 1,150 fully synthetic privacy-sensitive business workflows and 1,000 cases adapted from existing multi-tool and...

Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots

第一作者: Veronica Valeros · 方向: 安全研究

SSH蜜罐非交互式攻击网络欺骗安全测量隐藏英文摘要

Abstract:Cyber deception research has focused on improving honeypot deception capabilities to increase attacker engagement and extend their interactions to collect more and better intelligence. For SSH honeypots, this relies on the assumption that attackers log in, open a shell, and type. We tested whether this still held by deploying eleven SSH honeypots that served both interactive and non-interactive session requests for fifteen days. We collected 177,622 authenticated sessions and validated our results against an independent Cowrie dataset over the same time window. We found that 99.23% of sessions were non-interactive. Interactive sessions account for only 0.10%. The same pattern held in the comparative third-party dataset used for evaluation. This finding is important because a honeypot that focuses on interactive shells or evaluates success based on session length and the number...

论文介绍 本文研究SSH蜜罐中非交互式攻击的实际占比。通过部署11个蜜罐收集超17万个会话并与Cowrie数据集对比，发现99.23%的会话为非交互式，交互式仅占0.10%。这表明基于交互式Shell或会话长度的评估指标存在局限，提示网络欺骗研究需重新关注非交互式攻击。

AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception

第一作者: Muris Sladić · 方向: AI 安全

大语言模型SSH蜜罐多智能体网络安全欺骗防御隐藏英文摘要

Abstract:LLM-based SSH honeypots can generate believable interactions, but evaluations indicate they remain somewhat identifiable to determined attackers, indicating the need for a better scaffolding. We present a new LLM-based honeypot design that uses a multi-agent, multi-LLM architecture to address the limitations of the previous shelLM LLM honeypot. Our honeypot, called AdvancedShelLM, uses two LLM agents, a Manager and a Worker, that better understand the commands while reducing incorrect responses and increasing deception. It implements an advanced permanent filesystem, allowing many simultaneous attackers to see the same changing files for the first time. It was evaluated with: (i) unit tests for generative capabilities, (ii) an AI attacker (ARACNE) to assess realism and deception, (iii) human attackers to assess its deceptive capability, and (iv) an Internet deployment to...

论文介绍 针对大语言模型SSH蜜罐易被识破的问题，本文提出AdvancedShelLM系统。该系统采用多智能体架构，通过Manager和Worker双LLM智能体协作，提升命令理解并减少错误响应。同时引入持久文件系统，支持多攻击者共享动态文件状态，有效增强了蜜罐的交互真实感与欺骗防御能力。

SHARD: cell-keyed residual splitting for alignment-resistant private dense retrieval

第一作者: Sergey Kurilenko · 方向: 安全研究

密集检索隐私保护嵌入对齐攻击残差分割同态加密隐藏英文摘要

Abstract:Dense embeddings underpin semantic search and RAG, yet a leaked vector store hands much of the underlying text back to whoever holds it. The attacks that make this possible (few-shot alignment, zero-shot inversion, unsupervised cross-space translation) share one weakness: the protected store is a single global geometry that can be aligned to a known one. A secret global rotation, the usual lightweight defence, is no exception: orthogonal Procrustes recovers it once the attacker has about the subspace dimension in known pairs. We introduce Shard, a retrieval-preserving embedding transform that removes this weak axis. The centred embedding is split into a short public prefix (for stage-1 retrieval) and a private residual sharded into C cells under separate secret keys; the residual is reranked under CKKS, where the keys cancel and leave the inner product exact. A single...

论文介绍 针对密集检索中向量库易受对齐攻击导致文本泄露的问题，本文提出 SHARD 方法。该方法将嵌入分为公共前缀与私有残差，残差分割为带独立密钥的多个单元，并利用 CKKS 同态加密重排以精确计算内积。此方法有效抵抗对齐攻击，提升了语义搜索与 RAG 系统的隐私安全性。

Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK

第一作者: Veronica Valeros · 方向: 安全研究

网络欺骗MITRE ATT&CK诱饵部署欺骗面隐藏英文摘要

Abstract:Cyber deception research often assumes that a decoy can be placed wherever there is attacker behavior. This work tests that assumption across MITRE ATT&CK v18.1. We introduce a four-criterion rubric for infrastructure deception and apply it to all 250 ATT&CK techniques. The rubric evaluates whether a defender-controlled decoy can be placed, whether an attacker is likely to interact with it, what intelligence that interaction can yield, and whether the interaction reliably indicates malice. The resulting deception surface is sparse: only 80 techniques (32%) admit a decoy the attacker could plausibly reach. For the remaining 170 techniques, there is no defender-controlled asset in the attacker's path that can be fabricated as a decoy. Decoy placement across those 80 techniques falls into two patterns we call Sweep and Seek. In Sweep, the attacker moves broadly through assets in...

论文介绍 本文验证诱饵可任意部署的假设，提出基础设施欺骗四标准评估规则，对 MITRE ATT&CK 技术进行全面映射。研究发现欺骗面稀疏，仅 32% 技术支持合理诱饵部署，并将模式归纳为「Sweep」与「Seek」两类。该成果为精确部署网络欺骗提供量化参考。

Agentic AI-Powered Re-Identification: An Emerging, Scalable Threat to Mobility Microdata Privacy

第一作者: Oscar Thees · 方向: 软件安全

智能体AI重新识别移动微数据隐私大语言模型隐藏英文摘要

Abstract:The widespread collection of fine-grained location data by commercial data brokers creates a re-identification risk that is not widely recognised by the public. While prior research has established that mobility traces are highly unique and that individuals can, in principle, be identified from a handful of spatio-temporal points, such attacks have historically required significant manual effort from skilled analysts, limiting their practical scale. In this feasibility study, we demonstrate in a real world setting that agentic AI fundamentally changes this threat model. We present an end-to-end pipeline in which large language model agents autonomously search the open web, cross-reference public records and social media, and resolve raw coordinate sequences to candidate identities - without human intervention. We evaluate the pipeline on a spatio-temporal dataset containing...

论文介绍 本文针对商业位置数据收集的隐私风险，研究智能体AI在移动微数据重新识别中的威胁。研究构建端到端管道，利用大语言模型智能体自主搜索网络并交叉引用公开记录，将原始坐标序列解析为候选身份。该系统无需人工干预，表明智能体AI使位置数据重新识别具备高度可扩展性，对隐私保护构成新挑战。

Self-Verifying Measurement Records: Hash-Linked Evidence Graphs for Hardware Benchmarking

第一作者: Faruk Alpay · 方向: 系统安全

硬件基准测试防篡改记录哈希链接透明度日志静默错误隐藏英文摘要

Abstract:Performance numbers reported for hardware are accepted on trust: the reader cannot recompute them, the apparatus is gone, and the silicon itself can be silently wrong, with fleet studies reporting on the order of one core in a thousand returning incorrect arithmetic with no error raised. We make a reported hardware measurement a tamper-evident, independently checkable record. Every quantity in the text, a table, or a figure is bound, by its content hash, to the observation and the verification behind it; the whole is a hash-linked, append-only structure (a transparency log for measurement) that a verifier audits offline without trusting its producer. Matrix products are verified by a probabilistic identity (Freivalds) at O(k n^2) cost under a tolerance we derive from floating-point error analysis and calibrate to the device's own measured residual floor, so a wrong product is...

论文介绍 针对硬件基准测试数据难以复现且芯片可能存在静默算术错误的问题，本文提出自验证测量记录方法。该方法通过内容哈希将报告数值与验证过程绑定，构建防篡改的哈希链接透明度日志。结合概率恒等式与浮点误差分析验证矩阵乘积，使验证者可离线独立审计性能数据，无需信任生产者。

Exploring and Exploiting Synchrony Limitations of Time-Triggered Network-Agnostic Guardians

第一作者: Shreya Vithal Kulhalli · 方向: 系统安全

时间触发协议网络无关守卫时钟同步时序攻击隐藏英文摘要

Abstract:Time-triggered communication protocols rely on trusted components known as guardians to enforce adherence to predetermined network schedules. Network-agnostic guardians offer an efficient and scalable distributed solution with reduced implementation cost and complexity compared to network-aware alternatives. However, this efficiency is based on the guardian's dependence on the controlled node for clock synchronization, which introduces a vulnerability: a malicious node can exploit this dependency to launch timing attacks against its guardian and eventually interfere with messages from other nodes on the network. In this paper, we establish a theoretical lower bound on the attainable clock synchronization precision between a node and its network-agnostic guardian. Building on this result, we introduce a timing attack that leverages the unavoidably imperfect clock synchrony to...

论文介绍 本文研究时间触发通信协议中网络无关守卫的时钟同步局限性及其安全隐患。网络无关守卫依赖受控节点进行时钟同步，易受恶意节点利用。作者建立了节点与守卫间时钟同步精度的理论下界，并基于此提出一种利用不完美时钟同步的时序攻击方法，揭示了此类分布式系统的安全漏洞。

Reliable Homomorphic Matching for Fuzzy Labeled PSI at Scale

第一作者: Erkam Uzun · 方向: 密码学协议

模糊标签私有集合交集同态加密混淆电路秘密共享隐私保护匹配隐藏英文摘要

Abstract:Fuzzy Labeled Private Set Intersection (FLPSI) lets a receiver learn the labels of enrolled records similar to its query, and nothing else. Constructions based on a set-threshold reduction reach practical performance: a query matches a record when the two agree on a threshold number of components, and the private matching is delegated to an inner set-threshold kernel. We study its homomorphic form, which combines leveled-BFV homomorphic encryption (HE), a garbled circuit, and secret sharing to decide the match under encryption and release the record's label. We identify a composition gap in this kernel: efficiency is bought with a per-trial false-accept probability, but one query runs a trial for every record, so the error compounds with the database size into the kernel's realization soundness error (RSE), the rate at which it accepts a query the plaintext matcher would...

论文介绍 本文研究大规模模糊标签私有集合交集的可靠性问题。现有同态方案结合分层BFV同态加密、混淆电路与秘密共享实现密文匹配，但存在单次误接受概率随数据库规模复合放大的组合间隙。本文针对该实现健全性错误展开分析，旨在提升大规模隐私保护匹配的可靠性。

AdvScan: Black-Box Adversarial Example Detection at Runtime through Power Analysis

第一作者: Robi Paul · 方向: AI 安全

对抗样本检测功耗分析边缘计算TinyML隐藏英文摘要

Abstract:TinyML models deployed on edge devices are increasingly adopted in safety/security-critical applications, making them a prime target for adversarial example (AE) attacks where inputs are modified to cause misclassifications. However, existing AE detection methods either require white-box model access, which is often unavailable in licensed black-box deployments, or rely on input pre-processing stages that add non-trivial latency and resource overhead, often exceeding what mission-critical applications can afford on their inference path. To address these challenges, we propose AdvScan, a runtime power analysis-based methodology for AE detection that operates in a black-box scenario while inducing minimal latency. AdvScan is based on the observation that AEs produce anomalous neuron activations, which in turn generate distinctive power-consumption signatures. The algorithm...

论文介绍 针对边缘设备上TinyML模型易受对抗样本攻击且现有检测延迟高的问题，本文提出AdvScan方法。该方法基于运行时功耗分析，利用对抗样本引发的异常神经元激活会产生独特功耗特征的原理，在黑盒场景下实现低延迟的对抗样本检测。此研究为安全关键型边缘应用提供了轻量级防御方案。

On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models

第一作者: Dewank Pant · 方向: AI 安全

提示词注入大语言模型共享嵌入AI安全语义忠实控制隐藏英文摘要

Abstract:Prompt injection is the top security risk for LLM-integrated applications, yet every defense proposed so far has been broken. We prove this is not a coincidence: in shared-embedding architectures that lack enforced control-data separation, perfect prompt-injection prevention is mathematically impossible. We formalize prompted systems as Prompted Action Models whose outputs include control-authoritative actions: refusal decisions, tool authorization, policy routing, and memory writes. We define Semantic-Faithful Control (SFC), the property that such behavior depends only on the meaning of untrusted input, not on how it is encoded. We then prove SFC is unachievable within the shared pipeline, via three results: a provenance-recovery impossibility (shared representations make trusted and untrusted content statistically inseparable, bounded by total variation distance)...

论文介绍 本文针对大语言模型的提示词注入风险，证明了在缺乏控制与数据分离的共享嵌入架构中，完美防御该攻击在数学上不可能实现。研究将提示系统形式化为提示动作模型，提出“语义忠实控制”概念，并证明其在共享管道中无法达成。该工作揭示了现有防御失效的根本原因，为构建安全的LLM系统提供理论基础。

When the Aggregator Cheats: Data-Free Backdoors in Federated LLM-based QA Systems

第一作者: Chenqing Zhu · 方向: AI 安全

联邦学习大语言模型后门攻击聚合器安全问答系统隐藏英文摘要

Abstract:Large Language Model (LLM)-based question-answering (QA) systems are increasingly deployed in sensitive domains such as healthcare, mental health counseling, and legal consultation. Federated learning (FL) enables collaborative training without sharing raw client data, for which locally trained models are aggregated at a central server (i.e., a cloud service provider) to obtain a global model. In this paper, we explore the potential vulnerability where a malicious aggregator, who may collude with a third-party vendor, stealthily implants advertisement-type backdoors into federated QA models, without ever accessing client data. The attacker's goals are twofold: (1) preserve clean QA fidelity (i.e., the poisoned model behaves like a clean model on non-triggered queries); and (2) generate highly natural, contextually relevant responses with target advertisements when a trigger...

论文介绍 本文探讨大语言模型联邦问答系统的安全漏洞，提出一种无数据后门攻击方法。研究表明，恶意聚合器可在不访问客户端数据的情况下隐蔽植入广告型后门，既保持正常问答保真度，又能在触发时生成含目标广告的回复。研究揭示了联邦学习在敏感领域应用的风险，强调需加强对中心聚合器的信任审查。

How Humans, Bots, and Agents Communicate About Vulnerabilities in Pull Requests

第一作者: Pien Rooijendijk · 方向: 安全研究

漏洞沟通拉取请求智能体安全语言显式标识符隐藏英文摘要

Abstract:Developers may reference vulnerabilities in pull request discussions through both explicit identifiers, such as CVEs or GHSAs, and implicit security-related language (e.g., "unauthorized access" or "SQL injection"). Prior work has primarily focused on explicit identifiers, potentially overlooking vulnerability discussions that lack formal references. Bots and coding agents are becoming more common in pull requests, raising new questions about how different accounts communicate about vulnerabilities. In this registered report, we describe our planned study of vulnerability communication in pull requests by humans, bots, and coding agents. Building on the AIDev-pop dataset, we analyze explicit vulnerability references and implicit security-related signals across pull request titles, descriptions, review comments, commit messages, and timeline discussions. We further investigate...

论文介绍 本研究探讨人类、机器人与编程智能体在拉取请求中的漏洞沟通方式。针对以往仅关注显式标识符的局限，本文基于AIDev-pop数据集，分析拉取请求各交互环节的显式漏洞引用与隐式安全信号。研究旨在揭示不同账户在漏洞讨论中的行为差异，为理解自动化开发环境下的安全沟通机制提供新视角。