2026-07-04

An alternative approach towards attacks against fully-split PLWE instances

第一作者: Iván Blanco-Chacón · 方向: 安全研究

07/02 02:00

格密码学PLWE问题多项式环同构根攻击防御形式化证明隐藏英文摘要

In the present work we address some key questions regarding the generalization of root-based attacks presented in a recent work by the authors. In particular, we analyze potential root-based attacks extensions via the construction of explicit isomorphisms from vulnerable instances, and provide a formal proof that this approach will not yield any new vulnerabilities under a fully-split setting. To do so, we first construct an explicit isomorphism between fully-split polynomial rings and polynomial rings where previous attacks apply and show that the application of such an isomorphism will always distort the samples in a way that the resulting samples cannot be used to distinguish. Then, we prove that any isomorphism between fully-split polynomial rings must be of the form of the constructed isomorphism.

论文介绍 探讨格密码体制中多项式学习误差问题的破解路径，重点分析根攻击在全分割设定下的扩展潜力。构造多项式环间的显式同构映射，给出严格数学证明指出该映射必然扭曲样本分布致使区分器失效。证实特定同构变体无法衍生新型漏洞，为格基密码参数校验提供理论依据。

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

第一作者: Jiefei Liu · 方向: AI 安全

入侵检测系统生成式人工智能联邦学习数据增强隐私保护隐藏英文摘要

Abstract:Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network...

论文介绍 现代网络环境中入侵检测系统面临攻击演化、数据稀缺与隐私限制等挑战。本文综述生成式人工智能与联邦学习在入侵检测中的应用潜力，涵盖异常检测、合成流量生成、数据增强及分布式模型训练等技术路径，为构建高适应性且符合隐私合规要求的安全监测体系提供理论参考与方法指引。

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

第一作者: Michele Guida · 方向: AI 安全

大语言模型安全认知防火墙零信任架构多轮对话分析运行时防护隐藏英文摘要

Abstract:Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isolated messages, which limits their ability to recover ac-cumulated intent, verify asserted authority, or detect harmful objectives decomposed across a dialogue. This paper presents the Cognitive Firewall, a proactive runtime oversight framework that interposes an independent oversight model between a user and a protected target mod l. The framework decomposes safety assessment into four categorical gates: an intent gate that identi-fies the operational objective of a request, a zero trust context gate that treats claimed roles and permissions as unverified evidence, a consistency gate that detects escalation and decomposition across turns, and an...

论文介绍 针对大语言模型在多轮交互中隐藏有害意图的问题，本文提出「认知防火墙」这一主动式运行时监督框架。该架构通过独立审查模型对请求进行分解，依次执行意图识别、零信任上下文验证与跨轮次一致性检测，有效弥补传统单条消息评估机制的局限，提升复杂对话场景下的安全防护能力。

Embedding Inference Attack

第一作者: Cedric Fitiavana Raelijohn · 方向: 系统安全

07/01 10:56

嵌入推断攻击信息检索系统黑盒威胁模型模型指纹识别对抗查询构造隐藏英文摘要

Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores. We demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA). We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further...

论文介绍 传统嵌入模型泄露攻击通常依赖已知模型参数。本文研究黑盒信息检索环境下的安全威胁，提出「嵌入推断攻击」方法。攻击者仅通过观察无序返回的文档集合，利用定制化查询即可从候选列表中精准识别目标嵌入模型。即使系统引入重排序器防御，部分判别性查询仍能有效突破保护边界。

HTTP REST API Structure Learning

第一作者: Ran Dubin · 方向: 软件安全

REST API安全无监督异常检测流量行为建模接口漏洞识别自动化规则生成隐藏英文摘要

Abstract:Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07% and an F1-score of 87.24%, significantly outperforming alternatives when API...

论文介绍 针对HTTP REST API广泛使用带来的安全风险与文档缺失问题，本文提出HRAL无监督异常检测方法。该系统直接从网络流量中学习接口结构与运行行为，无需依赖预设规则或开发文档即可自动捕获偏离正常模式的可疑请求。实验表明该方法在低完整度文档环境下仍能保持高召回率与准确率。

Steerability via constraints: a substrate for scalable oversight of coding agents

第一作者: Thomas Winninger · 方向: 系统安全

编程智能体约束驱动控制代码审计规模化监督访问控制策略隐藏英文摘要

Abstract:Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest...

论文介绍 编程智能体的快速演进使人工审查成为瓶颈并引入安全隐患。本文主张将传统软件工程中的权限管控、网络策略与严格编码规范直接迁移至智能体底层，构建可规模化的监督基座。受控实验显示，结合轻量级命令行工具后，小型审查模型对含后门代码的检测召回率显著提升，大幅降低人工审核成本。

Securing People and their Machines Against Major Faults

第一作者: Ohad Eitan · 方向: 系统安全

草根去中心化平台私钥恢复机制社交图信任链身份保管人分布式容灾隐藏英文摘要

Abstract:We consider grassroots platforms -- distributed systems of agents consisting of people identified by self-chosen public keys and their machines (smartphones) -- and wish to make them secure against \emph{major faults}: the loss of their private keys and/or their smartphones. As grassroots platforms have no global resource to rely on for recovery, our peer-based solution is based on: (\ia) \emph{a grassroots social graph} in which agents establish and maintain friendships; (\ib) \emph{identity custodians}, designated by each person, and (\ic) \emph{state custodians}, which are grassroots platform-specific. Upon a person experiencing identity loss, and given a willing supermajority of the identity custodians of the person, the friends of the person replace the old public key with the new one across the graph and restore friendships, where all friends serve as state custodians...

论文介绍 面向缺乏全局恢复资源的草根去中心化平台，本文设计抗重大故障的分布式身份管理方案。系统基于用户社交关系图与双轨保管人机制，在网络设备或私钥丢失时，经多数可信保管人授权后自动替换公钥并重建社交连接，保障弱基础设施下用户身份与数据的持续可用。

Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

第一作者: Javier Irigoyen · 方向: 安全研究

07/02 22:04

人工智能风险评估监管合规风险管理框架伦理与社会影响方法论综述隐藏英文摘要

The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment (identification and analysis) and management methodologies. It begins by reviewing the worldwide regulatory landscape that drives the need for systematic AI risk assessment. Then we characterize the spectrum of AI-related risks identified in the literature, from technical failures to ethical and social impacts. Subsequently, it reviews key risk assessment methodologies proposed for AI systems, focusing on general frameworks. The paper highlights best practices and illuminates methodological gaps, highlighting areas for further research on AI risk assessment.

论文介绍 随着全球人工智能监管体系加速落地，系统化风险评估已成为保障智能系统安全可靠的必要环节。本文全面梳理现行法规背景下的风险分类光谱，涵盖技术失效至伦理社会影响等多维层面，对比分析通用型评估与管理方法，总结最佳实践路径并指出当前方法论空白，为后续标准化研究提供参考。

Privacy-Preserving and Verifiable Approximate Distributed Coded Computing

第一作者: Xavier Martínez-Luaña · 方向: AI 安全

分布式编码计算联合隐私保护拜占庭容错联邦学习安全模型无关架构隐藏英文摘要

Abstract:Distributed machine learning enables collaborative model training without centralizing data, but it also exposes learning processes to privacy leakage and malicious manipulation. Existing defenses typically address these threats in isolation and are often tailored to specific learning paradigms or model architectures, limiting their applicability in realistic deployments. In particular, federated learning and decentralized learning exhibit distinct adversarial surfaces that are rarely addressed within a unified framework. In this paper, we present a model-agnostic framework for adversary-resistant distributed learning that jointly addresses privacy preservation and malicious behavior across both federated and decentralized settings. Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique applicable to arbitrary...

论文介绍 分布式机器学习虽避免数据集中化，但仍面临隐私泄露与恶意篡改双重威胁。本文提出一种模型无关的统一防御框架，协同处理联邦学习与去中心化学习中的差异化对抗面。方案融合特定范式防护机制与通用编码计算技术，在保障计算结果可验证性的同时实现端到端隐私保护，适配多样化协作训练场景。

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

第一作者: Navaneeth Sangameswaran · 方向: AI 安全

AI安全宪法分类器多语言防护开放权重模型提示词安全隐藏英文摘要

Abstract:We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety constitution is the organising structure of the corpus: a natural-language constitution of 46 policies and 2,940 subcategories drives synthetic data generation, with exhaustive one-to-one paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline false positives (FPs), and balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks...

论文介绍 本文针对多语言场景下的输入安全防护问题，提出HaloGuard 1.0。该方法采用开放权重的宪法分类范式，以自然语言政策体系引导合成数据生成，并通过意图翻转的成对样本与双层误报处理机制提升分类精度。该模型在保持较小规模的同时实现多语言提示词安全评估，可广泛应用于跨语言大模型的合规过滤部署。

kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail

第一作者: Mahmoud Abdelfattah · 方向: AI 安全

大语言模型无训练护栏隐藏激活空间k近邻融合安全检测隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning...

论文介绍 针对现有大语言模型安全护栏依赖微调且延迟较高的问题，本文提出kNNGuard方案。该方法无需训练即可利用现成模型的隐藏激活空间构建护栏，仅需少量提示词样本提取特征，通过多层k近邻算法融合得分进行推理分类。系统显著降低计算开销并加速检测流程，适用于高并发业务中的实时提示词拦截。

ElephantAgent: Contextual State Continuity in Agentic Systems

第一作者: Jiankai Jin · 方向: 密码学协议

07/02 17:18

智能体系统上下文状态连续性记忆投毒防御协议验证工具调用安全隐藏英文摘要

Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior. These threats reflect a deeper issue: the lack of verifiable continuity in the agent's contextual state for planning and execution. We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning. Inspired by prior state-continuity mechanisms (e.g., Nimble), ElephantAgent extends this protection to the evolving contextual state of agentic systems. We define the contextual state as the bounded, security-critical subset of the agent's entire context (e.g., tool state and memory). Before processing each query...

论文介绍 面向智能体系统因外部工具与持久化记忆引入的安全隐患，本文提出ElephantAgent协议以保障上下文状态的连续性与可验证性。该方案将工具状态与记忆界定为有界上下文，在执行查询前校验状态完整性，有效抵御描述符篡改与记忆投毒攻击。该方法为动态规划环境提供底层可信支撑。

AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

第一作者: Shenao Wang · 方向: 软件安全

07/02 11:11

静态分析框架智能体依赖图提示工程代码语义解析软件安全检测隐藏英文摘要

LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents...

论文介绍 针对基于框架开发的大语言模型智能体程序存在传统工具难以追溯的复杂依赖关系，本文设计AgentFlow静态分析框架。该框架构建与实现无关的智能体依赖图，精准解析模型调用、提示模板、工具装饰器及多智能体编排逻辑。其恢复的代码级关联可用于自动化审计智能体行为，为系统漏洞排查提供技术支持。

Janus: a Playground for User-Involved Agentic Permission Management

第一作者: Natalie Grace Brigham · 方向: 系统安全

权限管理人机交互设计自主智能体决策辅助系统隐私保护隐藏英文摘要

Abstract:AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains under explored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios and three synthetic responders. We demonstrate that user input is critical and can significantly...

论文介绍 针对自主执行工具调用的智能体在权限分配上用户参与度不足的问题，本文推出Janus实验平台以支持用户介入式权限管理策略的设计与验证。平台包含模块化核心系统与自动化评测基准，通过多维设计轴线实现六种权限辅助助手并在多场景中量化比对。研究证实用户干预对决策具有关键影响，可为高信任度代理系统提供参考。

Unveiling the Non-Monotonic Effect of Privacy on Generalization under Byzantine Robustness

第一作者: Thomas Boudou · 方向: 系统安全

拜占庭鲁棒性局部差分隐私泛化误差算法稳定性分布式学习隐藏英文摘要

Abstract:Recent work has established a fundamental trilemma between Byzantine robustness, local differential privacy (LDP), and optimization error in distributed learning. We show that this trilemma does not universally extend to generalization error, but instead depends critically on the privacy regime. Specifically, in the high-noise regime (strong privacy), we prove that increasing privacy reduces the generalization error, i.e., there is no tension between robustness and privacy. In the low-noise regime (weaker privacy), however, the tension between robustness and privacy reappears and increasing privacy indeed degrades generalization. Our theory explains this surprising non-monotonic behavior of the generalization error via matching lower and upper bounds on the algorithmic stability of Byzantine-robust distributed learning under LDP constraints. We corroborate and further analyze...

论文介绍 本文探究分布式学习中拜占庭鲁棒性与局部差分隐私对模型泛化误差的非单调影响机制。理论分析表明，强隐私高噪声环境下提升隐私强度可降低泛化误差，而在弱隐私环境中两者仍存权衡关系。研究通过算法稳定性的上下界推导解释了该现象，为兼顾安全性与收敛性能的分布式机器学习框架设计提供理论指导。

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network

第一作者: Neda Abdolrahimi · 方向: 密码学协议

虚拟现实认证手势签名识别点体素交叉注意力网络沉浸式交互身份验证接口隐藏英文摘要

Abstract:Significant advancement of immersive technologies such as Virtual and Augmented Reality (VR/AR) and their integration into diverse aspects of modern life need authentication interfaces that are secure, intuitive, and compatible with embodied interaction. Traditional methods such as passwords, PINs, and device-based logins, break immersion and rely on external hardware. Recent 3D-specific behavioral approaches, such as hand-gesture, eye-tracking, and electroencephalography (EEG)-based methods, offer promising alternatives but often require specialized sensors or constrain natural movement, limiting usability in dynamic environments. We present Sign in the Air to Unlock, an in-air signature interface that enables users to authenticate by signing naturally in 3D space which is a familiar, personal, and reproducible gesture. To realize this interface, we design a point-voxel...

论文介绍 面向沉浸式虚拟增强现实设备对安全便捷认证接口的需求，本文提出空中签名解锁方案。该界面允许用户在三维空间中完成自然手势签名，后端依托点体素交叉注意力网络实现高精度姿态建模与特征匹配。方法摆脱对外部硬件传感器的依赖并保留自然活动自由度，适用于头显设备的身份核验与访问控制。

Black-Box Inference of LLM Architectural Properties with Restrictive API Access

第一作者: Christopher Ellis · 方向: AI 安全

黑盒探测大语言模型架构逆向接口限制绕过秘密推断安全评估隐藏英文摘要

Abstract:In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function), one can recover certain architectural details of an LLM, such as the hidden dimension of the feed-forward network. Perhaps in response to these results, most commercial LLM providers have restricted their APIs to expose only the single logit for each decoded token, and they no longer give users the ability to bias logits. We show that even under current restrictive APIs, several architectural parameters are still recoverable. We present NightVision, an attack that uses restrictive black-box API access to estimate the hidden dimension, depth, and parameter count of an LLM. Algorithmically, NightVision relies on a novel common set prompting technique...

论文介绍 针对商业大语言模型提供商通过收紧API输出限制以防止架构泄露的现状，本文揭示在黑盒单日志概率访问条件下仍可推断隐藏维度与网络层数。提出NightVision攻击方法，结合受限集合提示技术实现参数精确估计。该研究暴露了当前接口防护的潜在漏洞，为模型资产保护策略制定提供了威胁建模参考。