2026-07-07

An alternative approach towards attacks against fully-split PLWE instances

第一作者: Iván Blanco-Chacón · 方向: 安全研究

07/02 02:00

PLWE假设多项式环同构密钥推导安全形式化证明密码学攻击界限隐藏英文摘要

In the present work we address some key questions regarding the generalization of root-based attacks presented in a recent work by the authors. In particular, we analyze potential root-based attacks extensions via the construction of explicit isomorphisms from vulnerable instances, and provide a formal proof that this approach will not yield any new vulnerabilities under a fully-split setting. To do so, we first construct an explicit isomorphism between fully-split polynomial rings and polynomial rings where previous attacks apply and show that the application of such an isomorphism will always distort the samples in a way that the resulting samples cannot be used to distinguish. Then, we prove that any isomorphism between fully-split polynomial rings must be of the form of the constructed isomorphism.

论文介绍 本文探讨基于根的密码学攻击在全分裂PLWE实例中的推广边界。通过构造全分裂多项式环与旧有攻击适用环之间的显式同构映射，形式化证明该类扩展方法无法导出新漏洞。研究揭示同构变换必然扭曲样本分布使其丧失区分度，并严格推证所有合法同构均等价于所构造形式。结果为参数安全性论证提供数学约束。

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

第一作者: Jiefei Liu · 方向: AI 安全

入侵检测系统生成式人工智能联邦学习数据增强隐私保护隐藏英文摘要

Abstract:Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network...

论文介绍 本文针对网络环境中入侵检测模型面临的数据稀缺、攻击演进及隐私限制等挑战，综述了生成式人工智能与联邦学习的结合应用。研究重点探讨了生成模型在异常检测、流量合成与告警解释中的作用，以及联邦学习如何实现分布式安全训练。该方向为构建高鲁棒性且符合隐私合规的网络防御体系提供了系统性参考。

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

第一作者: Michele Guida · 方向: AI 安全

大语言模型安全认知防火墙零信任框架运行时审查意图识别隐藏英文摘要

Abstract:Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isolated messages, which limits their ability to recover ac-cumulated intent, verify asserted authority, or detect harmful objectives decomposed across a dialogue. This paper presents the Cognitive Firewall, a proactive runtime oversight framework that interposes an independent oversight model between a user and a protected target mod l. The framework decomposes safety assessment into four categorical gates: an intent gate that identi-fies the operational objective of a request, a zero trust context gate that treats claimed roles and permissions as unverified evidence, a consistency gate that detects escalation and decomposition across turns, and an...

论文介绍 本文指出传统大语言模型运行时防护仅孤立评估单条提示词，难以应对多轮对话中的累积有害意图。为此提出「认知防火墙」运行时监管框架，通过独立监督模型部署意图、零信任上下文、一致性及多轮演变四类关卡。该设计为复杂交互式场景下的模型输出控制提供了主动防御新路径。

Embedding Inference Attack

第一作者: Cedric Fitiavana Raelijohn · 方向: 系统安全

07/01 10:56

嵌入推断攻击信息检索系统黑盒查询模型指纹识别检索排序器隐藏英文摘要

Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores. We demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA). We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further...

论文介绍 本文聚焦隐藏于接口后的信息检索嵌入模型安全问题。在仅能观测无序召回结果的黑盒设定下，研究提出嵌入推断攻击方法，利用定制查询从候选集中精准识别目标模型的架构类型。该方法即使在系统引入重排序器作为防护机制时仍保持判别力，揭示了现代检索服务潜在的模型泄露风险。

HTTP REST API Structure Learning

第一作者: Ran Dubin · 方向: 软件安全

REST API安全无监督异常检测流量行为建模动态结构学习威胁识别隐藏英文摘要

Abstract:Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07% and an F1-score of 87.24%, significantly outperforming alternatives when API...

论文介绍 本文针对接口广泛使用带来的安全风险，提出HRAL无监督异常检测方法。该方法直接从网络流量中学习端点的结构与行为模式，无需依赖预设规则或文档说明即可有效标记偏离正常行为的操作。系统评估表明其在不完整文档场景下具备较高的误用检出能力，为自动化接口监控提供技术支撑。

Steerability via constraints: a substrate for scalable oversight of coding agents

第一作者: Thomas Winninger · 方向: 系统安全

代码智能体约束导向调控可扩展监管访问控制策略自动化代码审计隐藏英文摘要

Abstract:Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest...

论文介绍 本文探讨无约束代码智能体引发的安全与维护瓶颈，主张将传统软件工程中的权限管理、网络策略与强制规范转化为智能体的底层调控基底。研究表明，结合轻量级人工复核工具，该受限基底可大幅提升后门代码的检出率。研究为规模化管控自主编程系统提供了低成本、高可靠的技术路线。

Securing People and their Machines Against Major Faults

第一作者: Ohad Eitan · 方向: 系统安全

草根平台密钥恢复机制去中心化身份管理社交图拓扑容错系统设计隐藏英文摘要

Abstract:We consider grassroots platforms -- distributed systems of agents consisting of people identified by self-chosen public keys and their machines (smartphones) -- and wish to make them secure against \emph{major faults}: the loss of their private keys and/or their smartphones. As grassroots platforms have no global resource to rely on for recovery, our peer-based solution is based on: (\ia) \emph{a grassroots social graph} in which agents establish and maintain friendships; (\ib) \emph{identity custodians}, designated by each person, and (\ic) \emph{state custodians}, which are grassroots platform-specific. Upon a person experiencing identity loss, and given a willing supermajority of the identity custodians of the person, the friends of the person replace the old public key with the new one across the graph and restore friendships, where all friends serve as state custodians...

论文介绍 本文面向缺乏中心恢复资源的草根分布式计算平台，研究设备丢失与私钥损毁等主故障场景下的安全机制。方案依托用户自建社交图谱，通过指定身份保管人与状态保管人协同，在多数好友授权后自动完成公钥轮换与关系重建。该点对点恢复架构为弱中心环境下的连续认证提供了可行范式。

Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

第一作者: Javier Irigoyen · 方向: 安全研究

07/02 22:04

人工智能治理风险评估框架合规性管理伦理与社会影响监管政策分析隐藏英文摘要

The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment (identification and analysis) and management methodologies. It begins by reviewing the worldwide regulatory landscape that drives the need for systematic AI risk assessment. Then we characterize the spectrum of AI-related risks identified in the literature, from technical failures to ethical and social impacts. Subsequently, it reviews key risk assessment methodologies proposed for AI systems, focusing on general frameworks. The paper highlights best practices and illuminates methodological gaps, highlighting areas for further research on AI risk assessment.

论文介绍 本文梳理全球日益严格的人工智能监管趋势，系统综述面向智能系统的风险评估与管理方法论。内容涵盖从技术故障到伦理社会影响的全谱系风险特征，评析主流通用评估框架，并总结最佳实践与当前方法学空白。研究为构建符合法规要求的可信AI开发流程提供了结构化参考。

Privacy-Preserving and Verifiable Approximate Distributed Coded Computing

第一作者: Xavier Martínez-Luaña · 方向: AI 安全

分布式编码计算隐私保护对抗鲁棒性跨范型统一框架容错机器学习隐藏英文摘要

Abstract:Distributed machine learning enables collaborative model training without centralizing data, but it also exposes learning processes to privacy leakage and malicious manipulation. Existing defenses typically address these threats in isolation and are often tailored to specific learning paradigms or model architectures, limiting their applicability in realistic deployments. In particular, federated learning and decentralized learning exhibit distinct adversarial surfaces that are rarely addressed within a unified framework. In this paper, we present a model-agnostic framework for adversary-resistant distributed learning that jointly addresses privacy preservation and malicious behavior across both federated and decentralized settings. Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique applicable to arbitrary...

论文介绍 本文针对分布式机器学习面临的隐私泄露与恶意操纵双重威胁，突破现有防御手段孤立且依赖特定架构的局限，提出一套模型无关的统一应对框架。研究整合联邦与去中心化场景的专属防御机制，并结合隐私增强编码计算技术，实现近似计算的抗毁性与完整性验证，拓展了实际部署的适用边界。

HaloGuard 1.0: An Open Weights Constitutional Classifier for Multilingual AI Safety

第一作者: Navaneeth Sangameswaran · 方向: AI 安全

宪法分类器多语言安全提示词过滤合成数据生成轻量级防御隐藏英文摘要

Abstract:We present HaloGuard 1.0, an open-weights implementation of the constitutional-classifier paradigm for input safety. It achieves state-of-the-art performance on English and multilingual prompt-safety benchmarks at roughly one-tenth the model size of current leading open guard models. The safety constitution is the organising structure of the corpus: a natural-language constitution of 46 policies and 2,940 subcategories drives synthetic data generation, with exhaustive one-to-one paired counterfactuals that hold topic and vocabulary fixed while flipping intent, a two-tier harmless design that separately targets boundary and baseline false positives (FPs), and balanced multilingual materialisation across 46 languages that treats language as a surface form appearing on both sides of the boundary rather than as an adversarial signal. Across seven prompt-safety benchmarks...

论文介绍 针对大模型输入内容的安全风险，研究提出HaloGuard 1.0，一种基于开放权重的多语言宪法分类器。该方法利用自然语言政策框架构建训练语料，结合反事实数据增强与双层防误报机制提升分类性能。系统覆盖四十六种语言，为多语言场景下的轻量化AI安全防御提供了高效方案。

kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail

第一作者: Mahmoud Abdelfattah · 方向: AI 安全

无训练防护轨隐层激活k近邻算法推理延迟优化提示词检测隐藏英文摘要

Abstract:Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning...

论文介绍 针对现有大模型防护护栏依赖微调导致的泛化能力弱与推理延迟高问题，本研究提出kNNGuard。该方法无需训练或梯度更新，直接提取现成大模型的隐藏层激活特征，结合少量安全与非安全提示词构建多维度k近邻融合分类器。机制在保持高准确率的同时显著加速推理，为部署实时安全拦截系统提供高效配置方案。

ElephantAgent: Contextual State Continuity in Agentic Systems

第一作者: Jiankai Jin · 方向: 密码学协议

07/02 17:18

智能体系统上下文状态连续性状态投毒工具安全验证协议隐藏英文摘要

Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior. These threats reflect a deeper issue: the lack of verifiable continuity in the agent's contextual state for planning and execution. We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning. Inspired by prior state-continuity mechanisms (e.g., Nimble), ElephantAgent extends this protection to the evolving contextual state of agentic systems. We define the contextual state as the bounded, security-critical subset of the agent's entire context (e.g., tool state and memory). Before processing each query...

论文介绍 针对自主智能体调用外部工具与记忆时面临的状态投毒攻击，研究提出ElephantAgent协议。该协议通过界定并持续验证核心上下文状态集合，确保规划执行阶段的逻辑连贯性。机制引入状态延续保护防线，防止恶意注入扭曲行为，为复杂多阶段智能体任务的安全运行提供底层保障。

AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

第一作者: Shenao Wang · 方向: 软件安全

07/02 11:11

静态分析智能体依赖图框架语义解析代码可追溯性程序验证隐藏英文摘要

LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents...

论文介绍 面向基于框架开发的大模型智能体程序难以追踪新型依赖关系的问题，本研究推出AgentFlow静态分析框架。该框架自动从源代码中抽离框架特有的智能体构造、工具绑定与交接逻辑，构建与具体平台无关的智能体依赖图。此举填补了传统控制流与数据流分析的空白，为智能体程序的安全审计提供系统化支持。

Janus: a Playground for User-Involved Agentic Permission Management

第一作者: Natalie Grace Brigham · 方向: 系统安全

权限管理用户参与度智能体授权交互式评估人机协同决策隐藏英文摘要

Abstract:AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains under explored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios and three synthetic responders. We demonstrate that user input is critical and can significantly...

论文介绍 针对自主执行工具调用的智能体缺乏灵活权限管理机制的问题，本研究发布Janus仿真测试平台。该平台包含模块化智能体内核与自动化评估套件，围绕用户参与维度构建概念模型，并落地六种辅助授权策略。通过多场景交叉验证，系统证实用户适时介入可有效调控行为边界，为人机协同安全架构提供参考基准。

Unveiling the Non-Monotonic Effect of Privacy on Generalization under Byzantine Robustness

第一作者: Thomas Boudou · 方向: 系统安全

拜占庭鲁棒性局部差分隐私泛化误差算法稳定性非单调效应隐藏英文摘要

Abstract:Recent work has established a fundamental trilemma between Byzantine robustness, local differential privacy (LDP), and optimization error in distributed learning. We show that this trilemma does not universally extend to generalization error, but instead depends critically on the privacy regime. Specifically, in the high-noise regime (strong privacy), we prove that increasing privacy reduces the generalization error, i.e., there is no tension between robustness and privacy. In the low-noise regime (weaker privacy), however, the tension between robustness and privacy reappears and increasing privacy indeed degrades generalization. Our theory explains this surprising non-monotonic behavior of the generalization error via matching lower and upper bounds on the algorithmic stability of Byzantine-robust distributed learning under LDP constraints. We corroborate and further analyze...

论文介绍 分布式学习中拜占庭鲁棒性与局部差分隐私通常被认为存在理论冲突，但本研究揭示二者对泛化误差的影响呈非单调特性。在高噪声强隐私区间内，增强隐私保护反而能降低泛化误差；而在低噪声弱隐私区间则相反。理论推导通过算法稳定性的上下界匹配解释该现象，为隐私预算分配与鲁棒训练策略提供精确指导。

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network

第一作者: Neda Abdolrahimi · 方向: 密码学协议

虚实交互认证空间签名识别点体素注意力网络沉浸式登录三维手势验证隐藏英文摘要

Abstract:Significant advancement of immersive technologies such as Virtual and Augmented Reality (VR/AR) and their integration into diverse aspects of modern life need authentication interfaces that are secure, intuitive, and compatible with embodied interaction. Traditional methods such as passwords, PINs, and device-based logins, break immersion and rely on external hardware. Recent 3D-specific behavioral approaches, such as hand-gesture, eye-tracking, and electroencephalography (EEG)-based methods, offer promising alternatives but often require specialized sensors or constrain natural movement, limiting usability in dynamic environments. We present Sign in the Air to Unlock, an in-air signature interface that enables users to authenticate by signing naturally in 3D space which is a familiar, personal, and reproducible gesture. To realize this interface, we design a point-voxel...

论文介绍 为克服传统密码与外设登录方式破坏虚拟现实沉浸感的问题，本研究设计空中签名解锁界面。用户可在三维空间中通过自然书写手势完成身份核验，依托自研的点体素交叉注意力网络实现对非结构化运动轨迹的高效建模。该方法摆脱了专用硬件限制，兼顾安全性与操作直觉，适用于动态扩展现实设备的无感认证场景。

Black-Box Inference of LLM Architectural Properties with Restrictive API Access

第一作者: Christopher Ellis · 方向: AI 安全

黑盒探测模型架构还原限制型API对抗提示工程信息泄露隐藏英文摘要

Abstract:In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function), one can recover certain architectural details of an LLM, such as the hidden dimension of the feed-forward network. Perhaps in response to these results, most commercial LLM providers have restricted their APIs to expose only the single logit for each decoded token, and they no longer give users the ability to bias logits. We show that even under current restrictive APIs, several architectural parameters are still recoverable. We present NightVision, an attack that uses restrictive black-box API access to estimate the hidden dimension, depth, and parameter count of an LLM. Algorithmically, NightVision relies on a novel common set prompting technique...

论文介绍 针对商业大模型提供商收紧API返回字段导致架构参数难获取的现状，研究提出NightVision探测方法。即使接口仅暴露单Token概率且禁止偏置设置，该攻击仍能借助公共集合提示技术精准反推隐藏维度、网络深度及参数量。成果揭示了受限接口下的信息泄露风险，提示服务商需收敛输出粒度以阻断逆向分析。