|_Keywords_:<br>Digital twin<br>ICS<br>ATT&CK for ICS<br>LLMs<br>RAG<br>Attack graphs<br>Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry<br>is difcult because process observations reveal physical changes more directly<br>than the actions that produced them. This paper presents a Digital Twin (DT)-<br>assisted framework that extracts synchronized state changes,...
Mechanistic edits (ablations, weight edits, activation steering) are the standard tools for unlearning a harmful capability from a neural network while preserving useful ones. Current approaches validate their effects only by testing, which can never cover an entire continuous region of inputs. Prior work at the interpretabilityverification boundary certifies descriptions of a model: what a...
Suppressing a small set of routed experts can weaken the safety behavior of a sparse Mixture-of-Experts (MoE) language model without retraining. Which experts to suppress is therefore a security question, and the usual answer is activation frequency but frequency measures use, not influence. We test an alternative: router-gradient sensitivity, the sensitivity of the sequence loss to the gate...
Quantum Fourier sampling (QFS) appears to offer a direct route to auditing the spectral learnability of delay-based physical unclonable functions (PUFs). We ask whether that promise survives access matching, a strong classical comparator, and oracle synthesis, and report where it stops short. Three gates structure the evaluation. **Structure:** low degree is not small support at reachable...
Agent harnesses make many small, typed decisions per task: which model to call, which tool to use, whether retrieved text is relevant, whether an input carries an injection. _System1 decision models_ answer such questions in a single forward pass with class probabilities, promising large cost and latency savings over LLM calls. We present a paired evaluation of an open-weight (LAYA) and a hosted...
Federated Learning (FL) is a privacy-oriented learning paradigm that enables collaborative model training while keeping training data local to participating clients. However, it does not guarantee that clients submit policy-compliant contributions or that aggregators process admitted contributions correctly. Existing verifiable FL systems tailor validation rules to specific FL settings, learning...
Security benchmarks for LLM-based agents often report the attack success rate (ASR) as a measure of model robustness and use these scores to compare different models and defense mechanisms, assuming that they describe the security of the agent. Prior work has shown that tool metadata can influence agent behavior. In this paper, we explore whether it also influences the benchmarks measurement. We...
Recent studies have shown that most commercial direct time-of-flight (dToF) LiDARs can be spoofed by injecting high-frequency laser pulses into the receiver, which can erase pedestrians from the point cloud. This paper presents the first dToF LiDAR system-on-chip (SoC) with integrated sensor-level hardware security against spoofing attacks. We propose DualDomain Fingerprinting (DDF), which emits...
_AI services increasingly rely on black-box security guardrails, yet privacy-preserving model auditing regimes often cannot measure how well these systems perform in both a human eyes-off production setting, which disallows human inspection of user input, and a machine eyes-off setting, which disallows model inspection of such input. We introduce_ _**CorrectGuard**_ _, an eyes-off correctness...
LLM agents increasingly screen tool outputs with small prompt-injection detectors, and teams choose among detectors by their scores on public benchmarks. We ask whether those scores predict how a detector behaves inside an agent. We replay the ground-truth tool calls of two agent benchmarks, AgentDojo and -bench, without an LLM to obtain tool outputs that are benign by construction, label...
Large language model-based agents are increasingly deployed to perform domain-specific tasks by interacting with enterprise knowledge, tools, and external services. Existing runtime guardrails primarily target prompt injection and other attack-specific behaviors under a black-box threat model, but provide limited guarantees that agents operate within their intended functionality. As a result,...
The paper proposes and evaluates a five-layer defense‑in‑depth architecture that protects the perception‑reasoning interface of LLM‑driven UAV swarms against adversarial manipulation of sensor reports.
Hardware reverse engineering supports competitive analysis and hardware assurance by recovering information about an integrated circuit (IC) from its physical implementation. While existing techniques primarily recover the gate-level netlist, which represents logical functionality, they often overlook physical design decisions such as placement, routing, delay insertion, and interconnect...
• LiBRA (Latent In-band Bidirectional Removal Attack) is a detection‑aware watermark removal method that works in the latent space of a public autoencoder. • It applies bounded perturbations guided by a symmetric mean‑confidence objective to push the watermark toward random guessing from either direction, avoiding excessive inversion. • The goal is to evade the provider’s exact two‑sided binomial...
Workspace agents combine large language models with execution harnesses to perform stateful, multi-step tasks that access or modify external resources. Existing benchmarks leave gaps in executable coverage of their runtime security risks, while evolving model capabilities, harnesses, tools, and threats motivate benchmark evolution. We introduce **EvoRiskBench** , an evolving benchmark organized...
Open-weight language models can be downloaded, modified, and deployed beyond their developers control, limiting the effectiveness of centrally enforced safeguards. Recent work has therefore proposed **trigger-tag** mechanisms that produce a detectable signal when a model is used under a target condition, such as generating phishing contents. Although these mechanisms borrow from established...
Modern Computer Use Agents (CUAs) directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response. While the Dual-LLM pattern is the primary system-level architecture offering formal security guarantees using an isolated Planner LLM (P-LLM) to fix execution paths before processing...
Security workflows need models that turn complex observations and explicit policies into decisions. System One models introduced by Jev return typed predictions and probabilities; security specialization supplies the domain expertise behind those predictions. We introduce SecJev, to our knowledge the first family of Jev-like decision models specialized for security, spanning 0.8B to 9B...
• Problem: Traditional static analysis relies on predefined "sink" operations (e.g., command execution) but cannot distinguish secure from insecure usage because operation identity alone lacks context. • Solution: AgentSecGraph builds a candidate-centered Security-Aware Agent Dependency Graph (Security-ADG) for each detected security-sensitive operation, enriching it with agent relevance, source...
with observed feedback. This mismatch limits their ability to sustain convincing deception and keep autonomous agents engaged over multiple attack steps.
Autonomous penetration testing agents conduct multi-step attacks by continuously adapting their plans and actions to target responses. As a common defense, honeypots can be deployed to divert these agents from real assets by presenting decoy...
Large language model (LLM) agents are moving from chat interfaces into infrastructure operations, where they read telemetry, call tools, generate and execute code, and change the state of production Kubernetes clusters. This collapses a boundary that conventional cloud-native security assumes: the boundary between data and control. Content that an agent merely readsa log line, a ticket, a tool...
Large Language Model (LLM) watermarking provides a lightweight mechanism for identifying text generated by a specific model, but its robustness remains fragile under postprocessing attacks. Deletion attacks are particularly challenging because they shift token positions and break the alignment between observed tokens and their original watermark positions. We propose **ReedMuller Code...
Abstract. Threshold signature schemes play a vital role in securing digital assets within blockchain and distributed systems. FROST2 stands out as a practical threshold Schnorr signature scheme, noted for its efficiency and compatibility with standard verification processes. However, under the one-more discrete logarithm assumption, with static corruption and centralized key generation settings,...
Coding agents have become increasingly long-horizon, autonomous, reliant on general-purpose shell and maintain their own persistent memory for self-improvement. While these capabilities have made the agents powerful, they have also made them harder to defend against external adversaries. Defenses that restrict this architecturetyped tools, information-flow control, or policy prediction...
• Paper: Introduces a novel adversarial technique that exploits temporal aggregation in ML‑based IIoT intrusion detection. • Core Idea: By injecting minimal, flow‑calibrated timing drift, an attacker can shift packet timestamps across window boundaries without altering packet contents, causing the IDS to reconstruct a “phantom state” that diverges from the true process state. • Threat Model:...
• Problem: Manual creation of realistic Hardware Trojans (HTs) is labor‑intensive, lacks scalability, and often ignores structural context, limiting benchmark quality. • Solution: CITADEL automates HT insertion by combining Large Language Models (LLMs), Data Flow Graphs (DFGs), and the Common Weakness Enumeration (CWE) taxonomy to generate stealthy, synthesizable Trojans grounded in known...
Stablecoins support payments, trading, collateral, and cross-chain settlement across the digital-asset ecosystem. They also concentrate value behind issuer, custody, upgrade, oracle, and bridge keys while inheriting the quantum vulnerabilities of host-chain accounts, consensus, rollups, and privacy systems. This paper presents a Systematization of Knowledge (SoK) on post-quantum stablecoins. We...
Large language models (LLMs) embedded in production systems face prompt injections, trojans, and manipulation of automatic quality metrics. This thesis develops a set of models, methods, and algorithms for evaluating and improving the robustness of LLMs to adversarial input sequence variations: prompt injection, trojans (backdoor attacks), and attacks on agentic LLM systems. We propose _Rstab_ (...
Modern large language models (LLMs) are trained on massive, largely unfiltered datasets, including content scraped from nearly every accessible website and user inputs. As a result, LLMs often memorize and reproduce personally sensitive information (PSI) such as birth dates, phone numbers, and home addresses. This leads to significant privacy risks, particularly for high-profile individuals such...
arXiv:2610.02373v1 Announce Type: new
Abstract: GraphRAG pipelines construct auxiliary structures during offline indexing--semantic summaries, hierarchical edges, and pre-computed scores--that determine how retrieval is prioritised at query time. Prior attacks target only instance-level components (nodes, edges, triples), overlooking these schema-level structures. We formalise Auxiliary...