2026-07-03

An alternative approach towards attacks against fully-split PLWE instances

第一作者: Iván Blanco-Chacón · 方向: 安全研究

07/02 02:00

格密码学多项式环同构安全性证明后量子密码隐藏英文摘要

In the present work we address some key questions regarding the generalization of root-based attacks presented in a recent work by the authors. In particular, we analyze potential root-based attacks extensions via the construction of explicit isomorphisms from vulnerable instances, and provide a formal proof that this approach will not yield any new vulnerabilities under a fully-split setting. To do so, we first construct an explicit isomorphism between fully-split polynomial rings and polynomial rings where previous attacks apply and show that the application of such an isomorphism will always distort the samples in a way that the resulting samples cannot be used to distinguish. Then, we prove that any isomorphism between fully-split polynomial rings must be of the form of the constructed isomorphism.

论文介绍 针对基于根的格密码攻击在全分裂多项式环设定下的泛化可能性，本研究构造显式同构映射并给出严格形式化证明。结果表明该类映射必然扭曲样本分布，致使攻击者无法有效区分加密数据。该结论从数学层面排除了特定扩展攻击路径的有效性，为全分裂PLWE结构的安全性边界提供了理论界定。

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

第一作者: Jiefei Liu · 方向: AI 安全

入侵检测系统生成式人工智能联邦学习数据增强隐私保护隐藏英文摘要

Abstract:Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network...

论文介绍 本文综述了入侵检测系统在应对动态攻击、数据稀缺及隐私限制方面的挑战。研究聚焦于生成式人工智能与联邦学习的协同应用，前者支持异常检测、流量合成与数据补全，后者实现分布式模型训练而不共享原始网络数据。该框架为构建高鲁棒性、低通信开销的智能网络安全监测体系提供了技术路径。

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

第一作者: Michele Guida · 方向: AI 安全

大语言模型安全认知防火墙零信任架构意图识别运行时监控隐藏英文摘要

Abstract:Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isolated messages, which limits their ability to recover ac-cumulated intent, verify asserted authority, or detect harmful objectives decomposed across a dialogue. This paper presents the Cognitive Firewall, a proactive runtime oversight framework that interposes an independent oversight model between a user and a protected target mod l. The framework decomposes safety assessment into four categorical gates: an intent gate that identi-fies the operational objective of a request, a zero trust context gate that treats claimed roles and permissions as unverified evidence, a consistency gate that detects escalation and decomposition across turns, and an...

论文介绍 针对多轮对话中隐蔽诱导大语言模型生成有害内容的问题，现有防护机制常因孤立评估单条提示而失效。本文提出认知防火墙，通过在用户与目标模型间植入独立监督模型进行主动运行时管控。该系统依托意图识别、零信任上下文校验与跨轮次一致性检查等多重门控机制，有效拦截复杂对抗策略，提升交互安全性。

Embedding Inference Attack

第一作者: Cedric Fitiavana Raelijohn · 方向: 系统安全

07/01 10:56

嵌入推断攻击信息检索系统黑盒测试模型指纹识别隐私泄露隐藏英文摘要

Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores. We demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA). We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further...

论文介绍 信息检索系统通常将嵌入模型封装于后端接口，传统防御难以应对黑盒环境下的模型探测。本文提出嵌入推断攻击方法，通过精心构造查询序列并仅观察无序召回文档集合，即可在候选集中精准识别底层使用的嵌入模型。该方法在系统引入重排序器等防御机制时仍具判别力，揭示了检索架构的潜在隐私风险。

HTTP REST API Structure Learning

第一作者: Ran Dubin · 方向: 软件安全

API安全无监督异常检测网络流量分析RESTful架构行为建模隐藏英文摘要

Abstract:Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07% and an F1-score of 87.24%, significantly outperforming alternatives when API...

论文介绍 面向Web服务与微服务架构中日益严峻的接口安全威胁，本文提出REST接口结构学习方法。该技术摒弃对预设规则或文档的依赖，直接从网络流量中提取端点结构与行为特征以构建基线。实验表明，该方法在缺乏详细规范的情况下仍能准确识别偏离正常模式的恶意请求，为自动化威胁感知提供高效方案。

Steerability via constraints: a substrate for scalable oversight of coding agents

第一作者: Thomas Winninger · 方向: 系统安全

07/03 00:24

代码智能体约束引导人工审核优化访问控制可扩展性监管隐藏英文摘要

Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest where the...

论文介绍 自由演进的代码智能体易引发安全风险并降低代码库可维护性。本文论证将工程团队常用的访问控制、网络策略与严格规范迁移至智能体层面具有更高性价比。所构建的约束基底结合轻量级审查工具，使后门检出率显著提升，为低成本、可扩展的代码代理监管提供可行范式。

Securing People and their Machines Against Major Faults

第一作者: Ohad Eitan · 方向: 系统安全

去中心化平台身份恢复社交图谱密钥管理容错机制隐藏英文摘要

Abstract:We consider grassroots platforms -- distributed systems of agents consisting of people identified by self-chosen public keys and their machines (smartphones) -- and wish to make them secure against \emph{major faults}: the loss of their private keys and/or their smartphones. As grassroots platforms have no global resource to rely on for recovery, our peer-based solution is based on: (\ia) \emph{a grassroots social graph} in which agents establish and maintain friendships; (\ib) \emph{identity custodians}, designated by each person, and (\ic) \emph{state custodians}, which are grassroots platform-specific. Upon a person experiencing identity loss, and given a willing supermajority of the identity custodians of the person, the friends of the person replace the old public key with the new one across the graph and restore friendships, where all friends serve as state custodians...

论文介绍 针对草根去中心化平台因私钥丢失或设备损毁导致身份失效且缺乏全局恢复资源的问题，本文设计了一种基于对等网络的容错方案。该机制利用用户社交图谱关系、指定的身份保管人与状态保管人协作，在获得授权后自动替换公钥并重建连接。此方案为无中心架构下的身份自治提供保障。

Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

第一作者: Javier Irigoyen · 方向: 安全研究

07/02 22:04

人工智能风险治理合规框架风险评估方法论伦理影响监管政策隐藏英文摘要

The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment (identification and analysis) and management methodologies. It begins by reviewing the worldwide regulatory landscape that drives the need for systematic AI risk assessment. Then we characterize the spectrum of AI-related risks identified in the literature, from technical failures to ethical and social impacts. Subsequently, it reviews key risk assessment methodologies proposed for AI systems, focusing on general frameworks. The paper highlights best practices and illuminates methodological gaps, highlighting areas for further research on AI risk assessment.

论文介绍 伴随全球智能系统监管框架演进，确保安全可靠成为核心议题。本文系统梳理了风险评估与管理的方法论谱系，涵盖从技术故障到社会伦理的多维风险形态。研究对比现行通用评估框架，提炼最佳实践并指出当前研究空白，为开发者应对法规要求及完善内部风控流程提供理论指引。

Privacy-Preserving and Verifiable Approximate Distributed Coded Computing

第一作者: Xavier Martínez-Luaña · 方向: AI 安全

分布式机器学习隐私计算编码计算恶意防御去中心化训练隐藏英文摘要

Abstract:Distributed machine learning enables collaborative model training without centralizing data, but it also exposes learning processes to privacy leakage and malicious manipulation. Existing defenses typically address these threats in isolation and are often tailored to specific learning paradigms or model architectures, limiting their applicability in realistic deployments. In particular, federated learning and decentralized learning exhibit distinct adversarial surfaces that are rarely addressed within a unified framework. In this paper, we present a model-agnostic framework for adversary-resistant distributed learning that jointly addresses privacy preservation and malicious behavior across both federated and decentralized settings. Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique applicable to arbitrary...

论文介绍 分布式机器学习虽促进数据协作，却面临隐私泄露与恶意操纵双重威胁。现有防御手段多孤立处理单一攻击面且依赖特定架构。本文提出一种模型无关的统一框架，融合协议特定防护机制与隐私增强型编码计算技术，在联邦与去中心化场景下同步实现抗干扰训练与结果可验证性，拓宽了安全协作计算的应用范围。

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

第一作者: Navaneeth Sangameswaran · 方向: AI 安全

AI安全宪法分类器多语言开放权重提示词防护隐藏英文摘要

Abstract:We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety constitution is the organising structure of the corpus: a natural-language constitution of 46 policies and 2,940 subcategories drives synthetic data generation, with exhaustive one-to-one paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline false positives (FPs), and balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks...

论文介绍 针对多语言输入安全风险，本研究提出HaloGuard 1.0，一种基于宪法分类器范式的开放权重模型。该方法以自然语言宪法组织语料，结合反事实生成与双层误报抑制机制，在46种语言上均衡建模。其体积仅为现有先进开源模型的一成，可为多语言系统提供轻量级安全过滤能力。

kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail

第一作者: Mahmoud Abdelfattah · 方向: AI 安全

无训练护栏隐藏激活空间k近邻融合部署延迟优化提示词检测隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning...

论文介绍 面向大模型部署中的恶意提示词检测难题，本研究提出kNNGuard，一种无需微调的配置型防护框架。该方法直接提取现成模型的隐藏激活空间，结合少量示例通过多层k近邻算法融合特征进行实时分类。该方案显著降低推理延迟并提升泛化能力，适用于对响应速度敏感的生产环境。

ElephantAgent: Contextual State Continuity in Agentic Systems

第一作者: Jiankai Jin · 方向: 密码学协议

07/02 17:18

智能体系统上下文状态连续性记忆投毒防御协议设计工具调用安全隐藏英文摘要

Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior. These threats reflect a deeper issue: the lack of verifiable continuity in the agent's contextual state for planning and execution. We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning. Inspired by prior state-continuity mechanisms (e.g., Nimble), ElephantAgent extends this protection to the evolving contextual state of agentic systems. We define the contextual state as the bounded, security-critical subset of the agent's entire context (e.g., tool state and memory). Before processing each query...

论文介绍 针对智能体系统中外部工具与持久化记忆易受投毒攻击的问题，本研究提出ElephantAgent协议，旨在保障智能体规划执行过程中的上下文状态连续性。该协议将关键状态子集纳入前置校验机制，拦截恶意构造的上下文篡改，为构建抗干扰智能体架构提供可验证的一致性保障。

AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

第一作者: Shenao Wang · 方向: 软件安全

07/02 11:11

智能体程序分析静态依赖图谱框架语义解析代码审计代理交互逻辑隐藏英文摘要

LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents...

论文介绍 面向基于开发框架构建的智能体应用，本研究提出AgentFlow静态分析框架，用于提取传统工具难以识别的新型依赖关系。该方法构建去中心化依赖图，显式刻画代理构造函数、工具装饰器及协作流转路径。成果可为复杂智能体程序的漏洞审查与架构梳理提供自动化支持。

Janus: a Playground for User-Involved Agentic Permission Management

第一作者: Natalie Grace Brigham · 方向: 系统安全

权限管理用户参与设计智能体代理评估平台交互式控制隐藏英文摘要

Abstract:AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains under explored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios and three synthetic responders. We demonstrate that user input is critical and can significantly...

论文介绍 针对大模型自主代理执行工具调用时的权限分配难题，本研究推出Janus实验平台，聚焦用户介入智能体权限管理的协同机制。平台包含模块化核心系统与自动化评测框架，涵盖六种设计范式并在多场景中量化对比。结果为平衡代理自主性与人类可控性提供标准化测试依据。

Unveiling the Non-Monotonic Effect of Privacy on Generalization under Byzantine Robustness

第一作者: Thomas Boudou · 方向: 系统安全

拜占庭鲁棒性局部差分隐私泛化误差算法稳定性噪声机制隐藏英文摘要

Abstract:Recent work has established a fundamental trilemma between Byzantine robustness, local differential privacy (LDP), and optimization error in distributed learning. We show that this trilemma does not universally extend to generalization error, but instead depends critically on the privacy regime. Specifically, in the high-noise regime (strong privacy), we prove that increasing privacy reduces the generalization error, i.e., there is no tension between robustness and privacy. In the low-noise regime (weaker privacy), however, the tension between robustness and privacy reappears and increasing privacy indeed degrades generalization. Our theory explains this surprising non-monotonic behavior of the generalization error via matching lower and upper bounds on the algorithmic stability of Byzantine-robust distributed learning under LDP constraints. We corroborate and further analyze...

论文介绍 本研究探讨分布式学习中拜占庭鲁棒性与局部差分隐私对泛化误差的影响。理论分析表明二者张力随噪声强度呈现非单调变化：强隐私环境下增加保护反而改善泛化上限，弱隐私环境下则重现冲突关系。该工作通过算法稳定性界推演揭示了隐私约束与模型性能的动态权衡规律。

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network

第一作者: Neda Abdolrahimi · 方向: 密码学协议

虚实融合认证空签手势识别点体素交叉注意力沉浸式交互身份验证接口隐藏英文摘要

Abstract:Significant advancement of immersive technologies such as Virtual and Augmented Reality (VR/AR) and their integration into diverse aspects of modern life need authentication interfaces that are secure, intuitive, and compatible with embodied interaction. Traditional methods such as passwords, PINs, and device-based logins, break immersion and rely on external hardware. Recent 3D-specific behavioral approaches, such as hand-gesture, eye-tracking, and electroencephalography (EEG)-based methods, offer promising alternatives but often require specialized sensors or constrain natural movement, limiting usability in dynamic environments. We present Sign in the Air to Unlock, an in-air signature interface that enables users to authenticate by signing naturally in 3D space which is a familiar, personal, and reproducible gesture. To realize this interface, we design a point-voxel...

论文介绍 面向虚拟现实环境中缺乏兼顾安全性与自然度的身份验证方案问题，本研究设计空中签名交互界面，允许用户以三维自然书写手势完成核验。系统基于点体素交叉注意力网络处理空间轨迹特征，突破传统外设依赖。该接口为高沉浸感场景提供了一种直观的无接触认证路径。

Black-Box Inference of LLM Architectural Properties with Restrictive API Access

第一作者: Christopher Ellis · 方向: AI 安全

黑盒推理架构参数探测受限API访问提示词攻击大模型逆向隐藏英文摘要

Abstract:In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function), one can recover certain architectural details of an LLM, such as the hidden dimension of the feed-forward network. Perhaps in response to these results, most commercial LLM providers have restricted their APIs to expose only the single logit for each decoded token, and they no longer give users the ability to bias logits. We show that even under current restrictive APIs, several architectural parameters are still recoverable. We present NightVision, an attack that uses restrictive black-box API access to estimate the hidden dimension, depth, and parameter count of an LLM. Algorithmically, NightVision relies on a novel common set prompting technique...

论文介绍 针对商业大语言模型隐藏底层架构且收紧API接口的现状，本研究提出NightVision探测攻击。该方案仅依赖受限输出，通过共现集合提示技术重构隐藏层维度、网络深度及参数量级信息。结果为评估模型隐私边界及制定合规数据接口规范提供参考。