2026-07-05

An alternative approach towards attacks against fully-split PLWE instances

第一作者: Iván Blanco-Chacón · 方向: 安全研究

07/02 02:00

格密码学PLWE难题全分裂环同构变换安全性证明隐藏英文摘要

In the present work we address some key questions regarding the generalization of root-based attacks presented in a recent work by the authors. In particular, we analyze potential root-based attacks extensions via the construction of explicit isomorphisms from vulnerable instances, and provide a formal proof that this approach will not yield any new vulnerabilities under a fully-split setting. To do so, we first construct an explicit isomorphism between fully-split polynomial rings and polynomial rings where previous attacks apply and show that the application of such an isomorphism will always distort the samples in a way that the resulting samples cannot be used to distinguish. Then, we prove that any isomorphism between fully-split polynomial rings must be of the form of the constructed isomorphism.

论文介绍 本文聚焦多项式学习误差问题的安全性分析，探讨基于根的攻击在全分裂代数结构中的推广可行性。研究构建了两类多项式环间的显式同构映射，并给出形式化证明：该变换必然导致样本分布发生不可区分畸变，无法提取有效区分器。结论证实全分裂设定下不存在新型结构性漏洞，为格密码体制的参数设计与安全边界划定提供了严格理论支撑。

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

第一作者: Jiefei Liu · 方向: AI 安全

入侵检测系统生成式人工智能联邦学习数据隐私隐藏英文摘要

Abstract:Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network...

论文介绍 本文综述了生成式人工智能与联邦学习在入侵检测系统中的最新进展。针对网络攻击演化快、数据稀缺及隐私限制等挑战，生成模型可用于异常检测、数据增强与告警解释，而联邦学习支持分布式训练以避免原始流量共享。该研究为构建高可用、隐私保护的智能网络安全防御体系提供了理论参考与技术路径。

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

第一作者: Michele Guida · 方向: AI 安全

大语言模型安全认知防火墙零信任架构运行时监控隐藏英文摘要

Abstract:Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isolated messages, which limits their ability to recover ac-cumulated intent, verify asserted authority, or detect harmful objectives decomposed across a dialogue. This paper presents the Cognitive Firewall, a proactive runtime oversight framework that interposes an independent oversight model between a user and a protected target mod l. The framework decomposes safety assessment into four categorical gates: an intent gate that identi-fies the operational objective of a request, a zero trust context gate that treats claimed roles and permissions as unverified evidence, a consistency gate that detects escalation and decomposition across turns, and an...

论文介绍 本文提出「认知防火墙」框架，旨在解决大语言模型在多轮交互中隐藏的恶意意图难以被传统单一提示词评估机制识别的问题。该框架通过独立监督模型实现实时运行时干预，并构建意图识别、零信任上下文校验、跨轮次一致性检查等多维过滤门控。该方法可有效拦截隐蔽的越权操作与安全破坏行为，提升复杂对话场景下的模型防护能力。

Embedding Inference Attack

第一作者: Cedric Fitiavana Raelijohn · 方向: 系统安全

07/01 10:56

嵌入推理攻击信息检索系统黑盒环境模型指纹识别隐藏英文摘要

Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores. We demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA). We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further...

论文介绍 本文研究了白盒受限条件下信息检索系统的新型安全威胁。在仅能观察无序检索结果的黑盒设定下，攻击者可通过构造特定查询，从候选集中推断目标系统实际使用的向量嵌入模型。该「嵌入推理攻击」方法即使面对重排序器等防御机制仍具判别力，揭示了现有检索服务接口潜在的模型隐私泄露风险，为API安全防护提供新视角。

HTTP REST API Structure Learning

第一作者: Ran Dubin · 方向: 软件安全

REST API安全无监督异常检测网络流量分析结构学习隐藏英文摘要

Abstract:Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07% and an F1-score of 87.24%, significantly outperforming alternatives when API...

论文介绍 本文提出HRAL方法，用于直接基于网络流量对HTTP REST API端点的结构与行为进行无监督建模。该技术无需依赖预设规则或OpenAPI文档即可识别正常通信模式，并能自动标记偏离预期行为的潜在恶意活动。实验表明该方法在多种文档详略程度下均表现稳健，显著提升了缺乏完整接口规范时的漏洞与异常流量检测效能。

Steerability via constraints: a substrate for scalable oversight of coding agents

第一作者: Thomas Winninger · 方向: 系统安全

代码代理安全约束引导可扩展监管自动化审计隐藏英文摘要

Abstract:Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest...

论文介绍 本文探讨将传统软件工程中的访问控制、网络策略与强制编码规范迁移至代码生成代理的监管框架。通过引入底层约束机制与轻量级工具链替代复杂的提示词编排，可在降低计算开销的同时强化人工审查效率。受控实验显示，该约束基底配合基础审查模型后，对隐藏后门代码的检出率显著提升，为大规模自动化代码安全治理提供可行路径。

Securing People and their Machines Against Major Faults

第一作者: Ohad Eitan · 方向: 系统安全

去中心化身份恢复社交图验证密钥丢失防御分布式安全架构隐藏英文摘要

Abstract:We consider grassroots platforms -- distributed systems of agents consisting of people identified by self-chosen public keys and their machines (smartphones) -- and wish to make them secure against \emph{major faults}: the loss of their private keys and/or their smartphones. As grassroots platforms have no global resource to rely on for recovery, our peer-based solution is based on: (\ia) \emph{a grassroots social graph} in which agents establish and maintain friendships; (\ib) \emph{identity custodians}, designated by each person, and (\ic) \emph{state custodians}, which are grassroots platform-specific. Upon a person experiencing identity loss, and given a willing supermajority of the identity custodians of the person, the friends of the person replace the old public key with the new one across the graph and restore friendships, where all friends serve as state custodians...

论文介绍 本文面向由自主用户设备组成的草根分布式平台，提出应对私钥或终端丢失等重大故障的去中心化恢复方案。该系统依托用户自发构建的社交关系图，结合指定身份托管人与状态托管节点，通过多数派认证机制协助完成公钥替换与好友关系重建。该设计规避了对中心服务器的依赖，增强了弱拓扑环境下数字身份的抗损毁能力与持续可用性。

Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

第一作者: Javier Irigoyen · 方向: 安全研究

07/02 22:04

人工智能风险评估合规管理框架算法治理系统性风险分析隐藏英文摘要

The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment (identification and analysis) and management methodologies. It begins by reviewing the worldwide regulatory landscape that drives the need for systematic AI risk assessment. Then we characterize the spectrum of AI-related risks identified in the literature, from technical failures to ethical and social impacts. Subsequently, it reviews key risk assessment methodologies proposed for AI systems, focusing on general frameworks. The paper highlights best practices and illuminates methodological gaps, highlighting areas for further research on AI risk assessment.

论文介绍 本文系统梳理了国际监管背景下智能系统风险评估与管理的方法论演进。研究涵盖全球法规驱动的安全审查要求，归纳从技术失效到伦理社会影响的多维风险谱系，并对比主流通用评估框架的实施路径。文章明确了当前最佳实践与现存方法学缺口，为构建符合合规要求且兼顾技术创新的系统性风险治理体系提供参考。

Privacy-Preserving and Verifiable Approximate Distributed Coded Computing

第一作者: Xavier Martínez-Luaña · 方向: AI 安全

分布式机器学习隐私保护计算对抗鲁棒性编码协同计算隐藏英文摘要

Abstract:Distributed machine learning enables collaborative model training without centralizing data, but it also exposes learning processes to privacy leakage and malicious manipulation. Existing defenses typically address these threats in isolation and are often tailored to specific learning paradigms or model architectures, limiting their applicability in realistic deployments. In particular, federated learning and decentralized learning exhibit distinct adversarial surfaces that are rarely addressed within a unified framework. In this paper, we present a model-agnostic framework for adversary-resistant distributed learning that jointly addresses privacy preservation and malicious behavior across both federated and decentralized settings. Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique applicable to arbitrary...

论文介绍 本文针对分布式机器学习中的数据隐私泄露与恶意篡改问题，提出一种模型无关的统一防御框架。该方法突破单一范式局限，同时覆盖联邦学习与去中心化学习场景下的异构攻击面，结合特定协议防御机制与泛用型隐私增强编码计算技术，在保障近似计算精度的同时实现端到端的可验证性与抗攻击能力，适用于复杂协同训练部署。

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

第一作者: Navaneeth Sangameswaran · 方向: AI 安全

AI安全宪法分类器多语言提示词检测开放权重反事实数据生成隐藏英文摘要

Abstract:We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety constitution is the organising structure of the corpus: a natural-language constitution of 46 policies and 2,940 subcategories drives synthetic data generation, with exhaustive one-to-one paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline false positives (FPs), and balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks...

论文介绍 本研究针对大语言模型多语言输入安全风险，提出HaloGuard 1.0。该方法采用开源宪法分类器范式，通过自然语言政策构建合成数据集，并利用固定词汇翻转意图的反事实样本训练。系统在极小参数量下实现顶尖提示词安全检测，可为跨国平台部署高效自动化内容过滤提供支撑。

kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail

第一作者: Mahmoud Abdelfattah · 方向: AI 安全

大模型护栏隐层激活提取免训练检测多维特征融合低延迟推理隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning...

论文介绍 针对现有大模型护栏依赖微调导致泛化差与延迟高的问题，本文提出kNNGuard框架。该方案无需训练，直接提取现成模型隐藏层激活值，结合小规模安全样本进行多层k近邻融合分类。系统在保持媲美微调精度的同时显著降低推理开销，适用于需快速配置的高实时交互防护场景。

ElephantAgent: Contextual State Continuity in Agentic Systems

第一作者: Jiankai Jin · 方向: 密码学协议

07/02 17:18

自主智能体上下文状态连续性记忆与工具防注入可信执行验证动态权限审计隐藏英文摘要

Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior. These threats reflect a deeper issue: the lack of verifiable continuity in the agent's contextual state for planning and execution. We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning. Inspired by prior state-continuity mechanisms (e.g., Nimble), ElephantAgent extends this protection to the evolving contextual state of agentic systems. We define the contextual state as the bounded, security-critical subset of the agent's entire context (e.g., tool state and memory). Before processing each query...

论文介绍 面向自主智能体因调用外部工具与记忆而引发的状态投毒威胁，本文设计ElephantAgent协议保障上下文状态连续性。该机制将关键工具与记忆界定为安全子集，通过可验证连贯性校验拦截隐蔽行为偏差，可为高可靠智能体调度平台构建防篡改状态追踪基线。

AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

第一作者: Shenao Wang · 方向: 软件安全

07/02 11:11

智能体程序静态分析依赖关系图构建框架无关表示逻辑流追踪源代码审计隐藏英文摘要

LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents...

论文介绍 随着框架化智能体应用普及，传统控制流分析面临语义碎片化挑战。本文提出AgentFlow静态分析框架，首创智能体依赖图精准还原模型编排与工具交接等隐式依赖。该框架脱离特定底层实现，可为大规模代码库提供自动化漏洞扫描与逻辑验证能力。

Janus: a Playground for User-Involved Agentic Permission Management

第一作者: Natalie Grace Brigham · 方向: 系统安全

智能体权限治理用户参与机制权限助手设计自动化评估基准细粒度授权隐藏英文摘要

Abstract:AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains under explored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios and three synthetic responders. We demonstrate that user input is critical and can significantly...

论文介绍 针对自主智能体工具调用引发的权限分配难题，本文构建Janus平台系统探索用户参与型权限管理方案。平台集成模块化核心与自动化基准，覆盖六类授权策略并在多场景验证。研究证实人类介入对平衡自动化效率与安全边界具决定性作用。

Unveiling the Non-Monotonic Effect of Privacy on Generalization under Byzantine Robustness

第一作者: Thomas Boudou · 方向: 系统安全

分布式学习安全局部差分隐私泛化性能分析算法稳定性界噪声强度调节隐藏英文摘要

Abstract:Recent work has established a fundamental trilemma between Byzantine robustness, local differential privacy (LDP), and optimization error in distributed learning. We show that this trilemma does not universally extend to generalization error, but instead depends critically on the privacy regime. Specifically, in the high-noise regime (strong privacy), we prove that increasing privacy reduces the generalization error, i.e., there is no tension between robustness and privacy. In the low-noise regime (weaker privacy), however, the tension between robustness and privacy reappears and increasing privacy indeed degrades generalization. Our theory explains this surprising non-monotonic behavior of the generalization error via matching lower and upper bounds on the algorithmic stability of Byzantine-robust distributed learning under LDP constraints. We corroborate and further analyze...

论文介绍 本研究探讨拜占庭鲁棒性与局部差分隐私对分布式学习泛化误差的影响，突破传统优化误差认知局限。理论证明隐私强度与泛化能力呈非单调关联：高噪环境下增强隐私改善泛化，低噪环境则引发性能权衡。结论为联邦学习隐私预算动态分配提供数学依据。

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network

第一作者: Neda Abdolrahimi · 方向: 密码学协议

混合现实认证三维空间签名点云体素交叉注意无外设身份验证沉浸式交互隐藏英文摘要

Abstract:Significant advancement of immersive technologies such as Virtual and Augmented Reality (VR/AR) and their integration into diverse aspects of modern life need authentication interfaces that are secure, intuitive, and compatible with embodied interaction. Traditional methods such as passwords, PINs, and device-based logins, break immersion and rely on external hardware. Recent 3D-specific behavioral approaches, such as hand-gesture, eye-tracking, and electroencephalography (EEG)-based methods, offer promising alternatives but often require specialized sensors or constrain natural movement, limiting usability in dynamic environments. We present Sign in the Air to Unlock, an in-air signature interface that enables users to authenticate by signing naturally in 3D space which is a familiar, personal, and reproducible gesture. To realize this interface, we design a point-voxel...

论文介绍 面向虚拟现实环境中传统密码破坏沉浸感的痛点，本文提出「空中签名」身份验证接口。该系统依托用户在空中绘制熟悉手势完成鉴权，底层采用点云体素交叉注意力网络解析三维轨迹。方案摆脱传感器依赖，兼顾安全性与直觉性，适用于强沉浸场景的终端接入。

Black-Box Inference of LLM Architectural Properties with Restrictive API Access

第一作者: Christopher Ellis · 方向: AI 安全

模型架构逆向受限API探测参数规模估计常见集合提示技术知识产权防御隐藏英文摘要

Abstract:In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function), one can recover certain architectural details of an LLM, such as the hidden dimension of the feed-forward network. Perhaps in response to these results, most commercial LLM providers have restricted their APIs to expose only the single logit for each decoded token, and they no longer give users the ability to bias logits. We show that even under current restrictive APIs, several architectural parameters are still recoverable. We present NightVision, an attack that uses restrictive black-box API access to estimate the hidden dimension, depth, and parameter count of an LLM. Algorithmically, NightVision relies on a novel common set prompting technique...

论文介绍 针对商业大模型提供商收紧API权限隐藏结构的问题，本文揭示在严格限制下仍可逆向推断关键架构参数。研究提出NightVision攻击，利用常见集合提示技术准确估算网络深度与参数量。工作暴露闭源接口信息泄露风险，促使服务方重新审视元数据边界。