Embedded systems rely on sensor measurements that traverse a complex hardware-firmware stackperipheral interfaces, communication buses, memory, and driversbefore reaching the applications that use them. At worst, an attacker with access to this path may successfully intercept, overwrite, fabricate, or replay readings. This may cause systems that act on such data, such as flight controllers and...
Retrieved web text can carry instructions aimed at the language model, or synthetic pages written to mislead. We test whether released open-weight decision models, which answer typed questions about a text without generating tokens, can screen retrieved passages against both threats. On a benchmark of 1,000 questions over forum-style web pages with hidden injected instructions, a Kev-4B gate...
up to five orders of magnitude [9]. Until it is refitted, a fast tier may meet such an attack with nothing in its training data, recalibration or thresholds that resembles it; for the fast tier, the attack then belongs to an unseen family. The pipeline catches it only if the fast tier does not close it, and escalation has to stay within a budget on how much benign traffic the slow tier can...
Zirah is a hardware signer built around an STM32F407 microcontroller, and its purpose is to find out, on inexpensive hardware, where a post-quantum signing key is exposed and what actually protects it. The device draws every random bit from a reverse-biased 2N3904 junction in avalanche breakdown, amplified by an LM358 and screened by SP 800-90B health tests, computes ML-DSA-65 (FIPS 204, hedged)...
This research presents a formal game-theoretic model of agentic scambaiting—autonomous defensive agents that impersonate victims to consume scammer resources and extract actionable threat intelligence (mule bank accounts, cryptocurrency wallets) for infrastructure disruption.
Nowadays, large language models produce text at scale, and much of it is redistributed across platforms. A moderator who finds a suspicious comment, post or article may want to know which platform generated it and for which account. In this paper we study attribution over the channel through which such text actually travels, copy-paste, which discards document metadata but keeps Unicode code...
Reliable intra-swarm communication is fundamental to cooperative sensing, control, and mission execution in unmanned aerial vehicle (UAV) swarms. In open low-altitude shared-spectrum environments, coexisting UAVs may cause benign interference through spectrum reuse and signal leakage, while jamming UAVs may deliberately degrade critical intraswarm links. Since a jamming UAV can adjust its...
The Controller Area Network (CAN) bus lacks builtin security mechanisms, making real-time intrusion detection necessary. However, resource and latency constraints limit vehicle-side intrusion detection systems (IDSs) to lightweight models, whose detection performance and generalization can degrade under non-independent and identically distributed (non-IID) data. Meanwhile, uploading original CAN...
Indirect prompt-injection (IPI) benchmarks predominantly test planted instructions that redirect a tool-using agent toward an attacker-chosen task. Yet attacker-controlled content can instead tamper with the outcome of the task already in progress. For example, a buyers dispute evidence can cite a false refund policy to inflate the refund without redirecting the agent away from resolving the...
Researchers from Soongsil University present a defensive deception architecture against autonomous LLM agents that exploit web vulnerabilities. Rather than patching or blocking, the defender pre-plans a static honeypot from the application’s source code and routes confirmed attackers to an isolated shadow copy of the service, where their exploits succeed harmlessly while the real target remains...
JailBound is a unified framework for evaluating large language model (LLM) jailbreak robustness. It combines automated benchmark construction with first-order loss (FOL)-guided dual-branch search in embedding space to systematically probe safety boundaries across diverse threat conditions.
Mapping behavioral intelligence in malware analysis reports to ATT&CK techniques supports threat analysis and defense, but reliable identification remains challenging. Supporting evidence is often scattered across long, heterogeneous reports, while closely related techniques share behavioral cues and differ only in subtle but decisive details. While large language models (LLMs) can use external...
Enterprise AI agents increasingly split a users request across subagents and merge their results. Each handoff is a point where a requirement can be summarized away, altered by an intermediate agent, rewritten by an indirect prompt injection, or ignored by the merger. We report a preregistered, controlled study with synthetic, exactly scorable tasks that compares three handoff forms. The first is...
Programmable logic controllers often remain deployed for decades, making post-quantum attestation a long-term requirement. Prior measurements of OpenPLC attestation show that post-quantum signing can consume 8899 % of round-trip latency and that durable state can further limit throughput. We introduce AMORT-V1, a checkpointed attestation protocol that moves public-key signing and durable...
This research presents an adaptive attack, SimBreak, that defeats TraintoDefend, the first dedicated defense against cryptanalytic model extraction (NeurIPS 2025). TraintoDefend protects deep neural network (DNN) parameters by encouraging neurons to learn similar weights, theoretically forcing them to switch activation states together and obscuring individual signatures. The paper demonstrates...
Tool-using agents act on email, files, and payments, so an instruction hidden in a web page or a shared document can make an agent send data or money to an attacker. Many runtime defenses put a language model on the decision that lets an action through, so the decision depends on a model that may read the attackers text and adds model calls to every step. Provenance defenses keep the model off...
Standardised post-quantum cryptography (PQC) is critical for protecting software systems against future quantum threats, but standardised algorithms alone do not provide a pathway for their secure integration into software. This paper presents a Systematisation of Knowledge (SoK) of PQC integration in software development, synthesising existing approaches across implementation, migration, and...
Topic: AI-native, task-oriented semantic communications (SemCom) with intermediate relay nodes. Core Tension: Relay-assisted SemCom delivers significant performance gains but introduces a new class of insider security risks at the relay layer. ---
Replay attacks are difficult to detect in visionbased control systems because previously recorded observations can remain plausible while the physical system follows a different trajectory. This paper develops an adaptive dynamicwatermarking framework for detecting replay attacks against vision-based controllers. A private Gaussian watermark is added to the nominal control input, and a control...
Large language models (LLMs) undergo safety alignment to prevent harmful generations, yet they remain vulnerable to jailbreak attacks. Recent work reveals a deeper structural weakness: safety alignment can be highly sparse, such that pruning a small number of safety-critical neurons or ablating a single refusal direction can substantially undermine aligned behavior. In this work, we take the...
This technical report from Thales' Cybersecurity AI Team presents three practical defenses against data poisoning-based backdoor attacks targeting multi-stage Face Recognition Systems (FRSs). The assumed threat model: model training is performed in-house, but training data is sourced from potentially compromised third parties—a common supply-chain scenario for industry practitioners.
Fast Adversarial Training (FAT) reduces the cost of adversarial robustness by training on single-step attacks instead of expensive multi-step attacks. However, it is plagued by Catastrophic Overfitting (CO): robustness to strong attacks collapses to near zero mid-training while the single-step training attack continues to be repelled, making the failure invisible to the training loop.
Trinetra.Q is a unified statistical-and-behavioral detection layer for quantum computing systems. It targets two under-defended surfaces: the quantum-error-correction (QEC) syndrome/decoder pipeline and the classical control/software stack. The system is calibrated on honest operation and gated by statistical significance, producing zero false alarms on genuine hardware while detecting stealthy,...
Assurance-Conditioned Continuous Authorization (ACCA) is a harness-independent governance and authorization control plane for autonomous AI agents. It ensures an agent’s operational authority remains justified by current evidence, operating conditions, applicable policy, and stakeholder risk tolerance—rather than relying on static permission assignments.
Embodied Internet of Things (IoT) systems are promoting the adoption of task-oriented semantic communication (SemCom), in which the trustworthy task decisions require both semantic information reliability and source legitimacy. However, existing trustworthy designs in SemCom mainly focus on semantic content recovery and protection, with limited attention to source legitimacy. Motivated by this...
AI agents rely on third-party tools, such as Model Context Protocol (MCP) servers, whose publishers can be authenticated and whose execution can be restricted by runtime security policies. Yet authenticity does not guarantee benign behaviour: a legitimately signed tool may perform its advertised function while concealing malicious code that leaks confidential information. We demonstrate this...
Offline retrieval-augmented generation (RAG) on edge devices is updated through signed knowledge packs that carry text and precomputed embedding vectors. A signature proves who published a pack, not that its vectors encode its text. We study this textvector integrity gap. A verifier that recomputes vectors and accepts them within a cosine tolerance concedes a predictable share of queries to an...
Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce the delay between initial public disclosure and official National Vulnerability Database (NVD) scoring. Existing predictors, trained mainly on standardized late-stage descriptions, degrade on noisy and incomplete preNVD reports. We introduce PARSE, a vulnerability-disclosure...
Fault-resistant policy storage does not guarantee fault-resistant enforcement. We demonstrated this distinction on the RP2350A4 using differential photon-emission microscopy (PEM) and laser fault injection (LFI). PEM narrowed the area for laser scanning, which found two sites where pulses set the DEBUGEN bits enabling core 1 Secure debug. An online attack sequence using only Serial Wire Debug...
Abstract. The records that could train the most useful models, such as a hospital's patient files, are often the ones an institution cannot share. We propose CoRTeC, a method that releases synthetic versions of such records under differential privacy. Differential privacy places a proven limit on what the synthetic data can reveal about any person, and in particular on membership inference....