2026-07-22

Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

第一作者: Jie Li · 方向: AI 安全

07/21 04:16

LLM代理安全高性能计算劫持授权代理安全基准间接提示注入隐藏英文摘要

Large language model (LLM) agents are starting to take on routine work in high-performance computing (HPC), including monitoring Slurm jobs, diagnosing failed builds, inspecting simulation output, and coordinating scientific workflows. To do this work, an agent commonly acts under its user's credentials and inherits the user's access to files and the scheduler. This arrangement creates a failure mode that ordinary account-level controls do not capture. Adversarial instructions in a log, tool description, shared file, or peer-agent message may redirect the agent beyond the task the user assigned, even though every resulting command is authenticated and permitted for that account. We refer to this as the hijacked authorized agent problem. Existing agent-security studies explain relevant mechanisms, such as indirect prompt injection and tool misuse, but generally evaluate them in web...

论文介绍 LLM代理在高性能计算（HPC）中使用用户凭证执行任务，但可能被恶意指令劫持导致未授权行为，即“被劫持授权代理”问题。本文基准化评估LLM代理在HPC环境中的安全行为，揭示现有安全控制的不足，推动代理安全性改进。

0-Cyclic Equalizability of Binary Words Characterized by Hamming Weight

第一作者: Sarunyu Thongjarast · 方向: 软件安全

07/21 03:02

二进制词循环可等化性汉明权重卡牌密码学随机洗牌隐藏英文摘要

The random cut is one of the most fundamental shuffles in card-based cryptography: it rotates a sequence of face-down cards by a secret amount. Under this shuffle, two sequences of cards are indistinguishable if and only if they are cyclic shifts of each other. This motivates the question of whether, given two sequences of cards, inserting cards at matching positions can make them indistinguishable. A previous study shows that such an insertion is always possible when any cards may be inserted, as long as the two words are permutations of each other. This paper considers a stronger restriction: if the cards are binary, carrying only 0 or 1, can we insert only 0s to make the sequences indistinguishable? We call two words 0-cyclically equalizable if one can insert 0s into both sequences at matching positions so that the resulting words are cyclic shifts of each other. Our main result is...

论文介绍 本文研究卡牌密码学中二进制词的可等化性问题，即通过仅在匹配位置插入0，使得两个序列成为循环移位。核心贡献是基于汉明权重给出了0-循环可等化性的特征化，为相关密码协议的安全性提供了理论依据。

ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration

第一作者: Chengheng Li-Chen · 方向: AI 安全

07/21 02:56

LLM水印封闭校准模型无关哈希分区马尔可夫转移隐藏英文摘要

Regulatory regimes such as the EU AI Act mandate machine-readable marking of synthetic text, but existing watermark detectors rely on the generating LM and on heuristic thresholds with no closed-form calibration. We introduce ChainMark, an active watermark that partitions the vocabulary into S states via keyed SHA-256 and forces a hard Markov transition on a fraction rho of positions; the detector replays the partition from the same key in O(n) hash operations, with no LM access. We derive a closed-form S*(n, rho, alpha) mapping a target FPR, text length, and budget to the minimum state count (Theorem 1), prove a universal robustness threshold delta* = 1 - 1/sqrt(2) approximately 29.3% that is invariant in (S, rho, n) (Theorem 2), and generalise both to any k-regular transition topology (Theorem 3). Across three instruction-tuned LLMs and four domains, ChainMark strictly dominates KGW...

论文介绍 针对LLM生成文本的水印需求，ChainMark提出一种无模型方法，通过密钥哈希将词表分区并强制部分位置的马尔可夫转移。该方法有封闭形式的校准，无需访问语言模型，能在O(n)时间内检测，适用于合规性要求如欧盟AI法案。

Adversarial Robustness of Phishing Email Detection: A Comparative Study of TF-IDF + Logistic Regression and Fine-Tuned DistilBERT

第一作者: Tanveer Ahmed · 方向: AI 安全

钓鱼邮件检测对抗性鲁棒性TF-IDF逻辑回归DistilBERT隐藏英文摘要

Abstract:Phishing emails remain one of the most persistent cybersecurity threats, and machine-learning classifiers are widely used to detect them. Most reported detection accuracies, however, are measured on clean, in-distribution test data rather than on emails deliberately altered to evade detection. This paper reports a controlled, pairwise comparison of two phishing-detection approaches a TF-IDF + Logistic Regression baseline and a fine-tuned DistilBERT transformer trained on a unified corpus of 82,255 emails drawn from six public datasets and evaluated under three conditions: normal in-distribution, synthetic phishing, and adversarial phishing. Both models exceeded 98% accuracy on clean data yet degraded sharply under adversarial testing: TF-IDF + LR fell to 64.00% (a 34.59-percentage-point drop) and DistilBERT fell to 63.64% (a 35.40-percentage-point drop) a gap of only 0.36...

论文介绍 本文比较了TF-IDF加逻辑回归和微调DistilBERT在钓鱼邮件检测中的对抗性鲁棒性。在干净数据上准确率超98%，但在对抗性测试下均大幅下降，仅差0.36个百分点，表明两种方法在真实攻击场景下均面临挑战。

HALLMARK: Diagnosing Three Failure Modes in LLM Citation Verifiers

第一作者: Patrik Reizinger · 方向: AI 安全

LLM引用验证幻觉检测基准测试假阳性率HALLMARK隐藏英文摘要

Abstract:Large language models (LLMs) now routinely draft literature reviews and assist with academic writing, which means a higher risk of fabricated references: GPTZero found 53 papers with hallucinated citations among NeurIPS 2025's accepted set. Rule- and LLM-based verifiers are emerging, but no shared benchmark compares them and gives detailed failure diagnostics. We close that gap with HALLMARK (Hallucination benchmark): 2,526 BibTeX entries spanning 14 hallucination types, three difficulty tiers, six diagnostic sub-tests per entry, and a contamination-resistant held-out split. On it we evaluate a DOI-lookup baseline, frontier LLMs zero-shot, tool-augmented agents, and our own rule-based, co-designed verifier bibtex-updater. Across the benchmark one result is consistent: the false-positive rate, not recall, decides whether a verifier is deployable. HALLMARK makes it concrete...

论文介绍 随着LLM用于学术写作，虚构引用风险增加。本文提出HALLMARK基准，涵盖14种幻觉类型，用于诊断LLM引用验证器的失败模式。评估发现假阳性率是部署关键，为验证器开发提供了标准化测试框架。

PRISM: Sensitivity-Aware PolynoMial PRuning for EffIcient Neural Network Encryption

第一作者: Sahaj Majavdia · 方向: 密码学协议

07/20 13:47

神经网络剪枝同态加密敏感性感知可靠性PRISM隐藏英文摘要

Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32...

论文介绍 在同态加密下，神经网络推理需要高效剪枝。PRISM提出多项式敏感性感知剪枝方法，联合考虑权重大小、多项式激活敏感性和旋转成本，在保持可靠性的同时提升效率。实验显示其限制灾难性层失败，减少漏洞。

Quantum Cryptanalysis on IBM Quantum Hardware: Extending Even--Mansour Period Recovery from $N=4$ to $N=10$

第一作者: Taebong Kim · 方向: 系统安全

量子密码分析IBM量子硬件Simon算法Even-Mansour周期恢复隐藏英文摘要

Abstract:We report genuine-un-compiled, textbook-faithful-quantum cryptanalysis of symmetric-cipher structures executed on real IBM quantum hardware (ibm\_kingston, Heron generation). Using Simon's algorithm we recover the hidden period of the Even-Mansour cipher up to security parameter N = 10 on real hardware, beyond the largest previously reported real-hardware key recovery of N = 4, and we cleanly recover the periods of a 3-round Feistel (DES-family) construction at block sizes 6 and 8; a 21-qubit block-10 instance is verified in simulation and submitted to hardware. We further provide a breadth-first benchmark of five genuine quantum attacks spanning four symmetric-cipher design paradigms -- Bernstein-Vazirani (linear structure, single query), Grover (SPN key search, quadratic), and Simon (Even-Mansour, CBC-MAC forgery, and Feistel; exponential-to-polynomial in query complexity)...

论文介绍 本文在IBM量子硬件上执行量子密码分析，使用Simon算法成功恢复Even-Mansour密码的周期至N=10，并扩展到Feistel结构。这超越了此前硬件恢复的N=4限制，展示了量子计算对对称密码的实际威胁。

Shared Vulnerabilities in Robustness-Optimized Defenses: One Breach Exposes the Family

第一作者: Hanrui Wang · 方向: AI 安全

对抗性鲁棒性共享漏洞转移攻击鲁棒性优化安全风险隐藏英文摘要

Abstract:Adversarial robustness optimization aims to preserve correct prediction under adversarial perturbations, and has produced substantial robustness gains through methods such as adversarial training and adversarial purification. However, we identify a new security risk: these gains can create shared vulnerabilities across defenses. Once one representative robustness-optimized defense is effectively breached, the broader family may become exposed. Studying this risk requires separating genuine transferability from distortion-induced degradation and from the algorithmic gains of sophisticated attacks. We therefore introduce stricter transfer-only protocols and a deliberately simple adaptive attack, PGDTransfer, to test whether robustness-optimized defenses share transfer-only vulnerability under controlled conditions. We further introduce Adversarial Sensitivity Maps (AdvSMs) to...

论文介绍 鲁棒性优化如对抗性训练能提升模型鲁棒性，但本文发现其可能创建共享漏洞：一旦一个防御被攻破，同类防御可能暴露。通过引入严格转移协议和简单攻击PGDTransfer，研究验证了这一风险，为防御设计提供了新视角。

ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D

第一作者: Lena Libon · 方向: 系统安全

07/22 01:41

AI R&D自动化破坏检测监控ResearchArena隐藏英文摘要

As AI agents begin to automate AI R&D, we need ways to assess whether their outputs are safe to deploy, even when the agents themselves may be untrusted. AI control offers one such approach: rather than trusting the agent, it treats it as a potential adversary and uses a monitor to detect covert sabotage before deployment. We evaluate AI control for automated AI R&D with ResearchArena, a framework spanning four long-horizon tasks: safety post-training, capabilities post-training, CUDA-kernel optimization, and inference-server optimization. Because the deliverable in AI R&D is an artifact that will be deployed and run, we pair each main task with two kinds of hidden side task: an embedded side task that sabotages the submitted model, adapter, kernel, or server itself, and an independent side task that takes a covert out-of-scope action in the sandbox while leaving the artifact honest...

论文介绍 随着AI代理自动化AI研发，需确保其输出安全。ResearchArena框架评估AI控制方法，通过四个长期任务和隐藏副作用测试监控系统。它模拟真实场景，帮助检测代理的潜在破坏行为，为安全部署提供评估工具。

SoK: Adversarial Robustness of the Variational Quantum Eigensolver via Red-Teaming

第一作者: Ahmed Azaz Humdoon · 方向: AI 安全

07/22 01:38

变分量子特征值求解器对抗鲁棒性红队测试量子安全云服务隐藏英文摘要

The Variational Quantum Eigensolver (VQE) is a leading algorithm for estimating molecular ground-state energies on near-term quantum hardware, with applications spanning quantum chemistry, materials science, and drug discovery. As VQE workloads are increasingly deployed through cloud-based ``VQE-as-a-service'' pipelines, they become exposed to adversaries such as compromised service components, malicious co-tenants, or insiders in the transpilation stack, any of which can corrupt results before they reach the user. A range of attacks on variational quantum circuits has been proposed, but each has been studied in isolation: some on quantum classifiers with accuracy-based metrics, others on variational quantum algorithms with energy-error metrics. This lack of a common evaluation setup makes their relative severity difficult to compare and leaves the security of VQE poorly characterized...

论文介绍 本研究探讨变分量子特征值求解器在「VQE 即服务」云部署模式下的安全威胁，攻击者可能通过恶意组件或内部操作破坏结果。提出红队测试方法，系统评估不同攻击场景的对抗鲁棒性，旨在统一评估框架，为量子算法的安全部署提供基准和防护策略。

Code Division Modulation Layers Against Forgetting and Inference in Continual Gait Identification

第一作者: Simone Milani · 方向: 软件安全

持续学习步态识别隐私保护码分调制层对抗遗忘隐藏英文摘要

Abstract:Continual learning (CL) has been recently employed in biometric identification systems thanks to its ability to integrate new knowledge within a pre-trained model and to the possibility of reducing the computational cost of training. Unfortunately, such approaches pose new challenges both in terms of final accuracy and privacy guarantees since a progressive fine-tuning of the model on small subsets expose them to catastrophic forgetting and successful inference attacks. This paper evaluates the efficiency of code division modulation layers (CDML) on a gait identification system which has been trained following a continual learning policy. The proposed approach preserves accuracy on all the tasks while mitigating membership inference attacks at the same time. Moreover, the impact of retransmission is minimized since replaying data is not necessary.

论文介绍 针对持续学习在步态识别系统中应用时面临的灾难性遗忘和推理攻击问题，本文提出码分调制层作为解决方案。该方法在保持所有任务识别准确性的同时，能有效防御成员推理攻击，无需数据重放，提升系统在动态环境中的隐私和鲁棒性。

SFGA: A Statistics-First Gating Architecture with Adjudicative Escalation for Trustworthy SFT Data Procurement

第一作者: Arther Tian · 方向: 网络安全

监督微调数据采购统计评估门控架构辩论机制数据质量隐藏英文摘要

Abstract:Procuring supervised fine-tuning (SFT) data forces a buyer to decide, before any downstream training, whether a candidate corpus is worth acquiring. We present \sys{}, a statistics-first gating architecture that treats procurement as a cost-aware routing problem over three intrinsic quality axes -- diversity, utility, and redundancy. Cheap blind measurements are summarised into per-axis estimates with confidence intervals; a gate accepts a decision only when intervals are tight, sample sizes are adequate, and the axes agree, otherwise it escalates the case to an adjudicative debate between a buy-advocate and a reject-advocate judge, resolved by a presiding verdict. On a controlled benchmark of 12 datasets ($2{\times}3{\times}2$ grid over the three axes) with 5 seeds, the gate reaches 0.90 accuracy and 0.83 $F_1$ at \$0.017 per unit, sitting between an always-verify baseline...

论文介绍 监督微调数据采购中，买家需提前评估数据质量。本文提出统计优先门控架构，基于多样性、效用和冗余三个维度进行成本感知路由，通过辩论机制解决不确定性。实验显示该方法在准确性和成本效益间取得平衡，适用于可信数据采购场景。

Private Approximation of Graph Spectra and Cuts via Spectral Amplifiers

第一作者: Chenglin Fan · 方向: 隐私保护

图谱近似差分隐私割大小合成图隐私保护算法隐藏英文摘要

Abstract:We study the problem of releasing a synthetic graph that approximates the sizes of all cuts of an input graph under edge-level differential privacy. If one insists on purely additive error, the optimal worst-case error is $\widetilde\Theta(n^{3/2})$. If one allows a small multiplicative slack, an information-theoretic exponential-time mechanism achieves nearly linear additive error, but the best known polynomial-time algorithms have substantially larger error. We give a polynomial-time $(\varepsilon,\delta)$-differentially private algorithm which, for every $n$-vertex unweighted graph $G$, outputs a non-negative weighted synthetic graph $\widetilde G$ such that, with high probability, every cut $S\subseteq V(G)$ satisfies \[ |w_G(S)-w_{\widetilde G}(S)| \le \gamma w_G(S)+\widetilde O_{\varepsilon,\delta,\gamma}(n^{13/12+o(1)}). \] This improves the previous polynomial-time...

论文介绍 研究在边级差分隐私下发布合成图以近似原始图的所有割大小问题。提出多项式时间算法，使用谱放大器生成非负加权合成图，在概率意义上实现近似误差控制，改进了先前算法的误差界，平衡了隐私保护与数据可用性。

Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA

第一作者: Shaswata Mitra · 方向: 安全研究

07/21 13:32

小型语言模型微调网络安全问答诊断框架模型选择隐藏英文摘要

Large Language Models (LLMs) are increasingly fine-tuned for critical-domain Question-Answering (QA), yet choosing which small model to adapt, before paying the cost of adaptation, remains difficult. Fine-tuning can improve domain alignment, but it may also erode prior knowledge, weaken instruction-following, or increase hallucination, especially when labeled data are scarce or rapidly evolving as in cybersecurity. We present FiT (Find before Fine-Tune), a task-oriented diagnostic framework that characterizes small LLMs along three capabilities required for cybersecurity QA: vocabulary recognition, parametric knowledge, and contextualization of retrieved information. Using FiT, we conduct an empirical study of five open-weight 7-billion-parameter models under two fine-tuning regimes. We find that fine-tuning does not uniformly help: it consistently degrades vocabulary and parametric...

论文介绍 针对小型语言模型在网络安全问答中微调效果不明的问题，提出诊断框架 FiT，评估词汇识别、参数化知识和信息上下文化能力。研究发现微调可能损害模型原有能力，为模型选择和微调策略提供实证指导，适用于安全关键领域应用。

Attacking Graph Foundation Models Through Their Shared Representation

第一作者: Pankaj Kumar · 方向: AI 安全

图基础模型共享表示推理攻击对齐层模型脆弱性隐藏英文摘要

Abstract:A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the...

论文介绍 图基础模型通过共享表示层映射输入，但该层存在安全漏洞。本文在推理时对齐层进行定向扰动攻击，使模型在多个公开模型上崩溃，揭示了对齐层特有的脆弱性，为模型设计和安全评估提供新视角。

PIP-NTT: Towards a Scalable Memory-Parallelized Accelerator for Iterative NTT in PQC

第一作者: Malik Imran · 方向: 密码学协议

数论变换后量子密码硬件加速器内存并行化密码学实现隐藏英文摘要

Abstract:The iterative forward and inverse number theoretic transform (NTT) is a key component in lattice-based post-quantum cryptography (PQC), typically implemented using Cooley-Tukey and Gentleman-Sande butterfly units. Existing iterative NTT accelerators often rely on ping-pong memory schemes and large memory blocks tied to the cyclotomic ring, which limits overall efficiency. To overcome this, we propose a memory-parallelization strategy using four smaller n/4-sized memories for ring size n, preserving the total memory footprint of conventional designs. We also introduce a multiplication-free rescaling architecture for the inverse NTT. Building on these innovations, we perform a comprehensive hardware-based design space exploration of unified Cooley-Tukey and Gentleman-Sande butterfly units, evaluating both coarse- and fine-grained pipelining strategies. The resulting optimized...

论文介绍 后量子密码中迭代数论变换的硬件加速面临效率挑战。本文提出内存并行化加速器设计，使用小型内存块和免乘重缩放架构，优化统一蝶形单元流水线策略，旨在提升性能和可扩展性，推动密码算法硬件实现。

A Decision-Centered Reference Architecture for Trustworthy Agentic Commerce

第一作者: Dimitrios S. Sfiris · 方向: 密码学协议

代理商业参考架构决策信任协议无关安全验证隐藏英文摘要

Abstract:Agentic commerce extends agentic shopping into software agents that interpret policy, prepare checkout, generate transaction-facing language, and act under delegated payment authority. Protocols standardize external exchanges, but merchants still need one authoritative representation of commercial eligibility, actor authority, checkout validity, payment dispatch, generated claims, and evidence. This design-science study presents a protocol-agnostic architecture built around a canonical envelope, protected dependency and result hashes, Ed25519 or HMAC authentication, live-request rebinding, a seven-axis generated-claim gate, execution-time dependency revalidation, and eleven semantic invariants. Evaluation used an open-source JavaScript implementation, eight deterministic ecommerce scenarios, and five controlled ablations. Seven initially valid actions were permitted. After...

论文介绍 代理商业系统需确保决策信任和安全。本文提出协议无关的参考架构，围绕规范信封、身份验证和语义不变量构建，通过执行时重验证和生成声明门控机制，标准化商业流程，提升代理系统的可靠性和安全性。