TLS (i.e., HTTPS), since TLS encrypts only the application payload, leaving network- and transport-layer headers and traffic characteristics (packet sizes, timings, and ordering) observable to on-path adversaries. Website fingerprinting leverages this residual metadata to reconstruct browsing patterns and compromise user privacy.
Website fingerprinting (WF) attacks can infer which webpage a...
Current Large Language Model (LLM) safety evaluations often rely on binary "pass/fail" metrics, such as Attack Success Rate (ASR). This approach fails to capture the nuance of how models respond to varying degrees of subtlety in harmful prompts. The TIER (Threat Implicitness Benchmark) research introduces a more granular framework to evaluate how LLMs transition from complete refusal to full...
Multiple-input multiple-output (MIMO) technology is fundamental to modern wireless communication. Physical layer security seeks to protect transmitted information by exploiting properties of the noisy communication channel. Dean and Goldsmith proposed a polynomial time reduction from lattice problems to MIMO decoding by adapting Regevs reduction for learning with errors (LWE). If valid, this...
The research introduces TPMSpy, a novel, platform-agnostic method for validating the integrity of the Measured Boot process. By utilizing a virtualized environment to intercept communications between a system and a software-emulated Trusted Platform Module (swTPM), the researchers can independently reconstruct the TPM Event Log to ensure it accurately reflects all system measurements.
ReCAST is a training framework designed to combat the increasing use of adversarial obfuscation in fraudulent Chinese SMS messages. While Large Language Models (LLMs) are capable of "de-obfuscating" text, they are too slow and expensive for high-throughput production environments. ReCAST solves this by distilling the restoration capabilities of a massive teacher model into a lightweight student...
This research addresses a critical flaw in how stateful LLM agents (long-running AI assistants) handle the "forgetting" of information. While current systems typically delete a plaintext record from a database to satisfy a "forget" request, the information remains embedded in the agent's active runtime state—specifically in KV caches, compressed summaries, and pending tool plans. This results in...
Current ransomware detection methodologies often struggle to balance high-accuracy multimodal analysis (combining static, dynamic, and memory forensics) with the significant computational costs and latency those methods incur. This research introduces a Cost-Aware Hierarchical Multi-Agent System (HMAS) designed to perform adaptive evidence acquisition. Instead of applying expensive analysis to...
Researchers have identified a novel class of physical attacks called Injection-Induced EM Side Channels. While traditional electromagnetic (EM) side-channel attacks are passive (listening to unintentional emissions), this new method uses active EM injection to force hardware to "broadcast" secrets that were previously too low-frequency or too weak to be intercepted remotely.
Machine learning is widely used for malware detection, but its decisions must be explained. An analyst needs to know whether a model has learned genuine malicious behavior or only dataset-specific patterns [1]. SHapley Additive exPlanations (SHAP) is the standard tool for this, backed by formal properties such as local accuracy, missingness, and consistency. We argue that these guarantees are...
Partitioning interacting services into independently rooted trust domains limits issuer-compromise reach while increasing calls across trust boundaries. Post-quantum replacements for public-key authentication and key-establishment mechanisms can increase crossing latency on constrained or lossy paths. We formulate the joint selection of trust domains and credential-derivation structures under...
Research has identified a critical vulnerability in Vision-Language Models (VLMs) used by AI agents. While previous research focused on "white-box" attacks or scenarios where no competing user task exists, this paper introduces Repeat-After-Me (RAM), a highly effective black-box attack that works even when the model is performing a legitimate, benign task requested by a user.
Recent research has identified a critical vulnerability in Federated Unlearning (FU) systems. While FU is designed to provide privacy by allowing users to "delete" their data from a shared machine learning model without full retraining, the mechanism used to make this efficient—broadcasting updated "ridge" classifiers—creates a significant side-channel. An active attacker can exploit these...
Large language models can insert workplace details into phishing pretexts at low cost, but those details may either support or undermine a messages credibility. We recruited 180 U.S. working adults to evaluate simulated, AI-generated phishing emails in a disclosed survey. The emails used four cumulative levels of information: workplace (Level 1); recipient name and job title; job...
Machine Learning-based Network Intrusion Detection Systems (NIDS) are susceptible to "concept drift," where evolving network traffic and novel attacks degrade model accuracy. While most systems implement a "detect-then-retrain" loop, this research identifies a critical security flaw: the assumption that a detected drift automatically justifies replacing the current model (the incumbent) with a...
This research identifies a critical design defect in Split-Learning (SL) architectures used for training Large Language Models (LLMs). While these systems use "decoys" (chaff) to hide real data rows from untrusted cloud providers, a vulnerability in the "backward wire" (the gradient return path) allows an attacker to perfectly distinguish real data from decoys, nullifying the privacy protections.
This research addresses the vulnerability of Multi-Agent Systems (MAS)—such as smart grids and healthcare management systems—to goal inference attacks. In these distributed environments, agents must communicate to achieve collective objectives; however, these communication patterns can be exploited by adversaries to infer "latent goals" (e.g., sensitive operational strategies, mission objectives,...
FedIoC is a proposed modular framework designed to solve the "fragmentation problem" in Cyber Threat Intelligence (CTI). Normally, detecting a wide-scale campaign requires organizations to share raw Indicators of Compromise (IoCs), which is often hindered by privacy laws (GDPR, NIS-2) and corporate reluctance. FedIoC uses Federated Learning (FL) to identify "campaign cohorts"—groups of...
arXiv:2609.04535v1 Announce Type: cross
Abstract: Static application security testing (SAST) tools help developers find vulnerabilities before deployment, but false positives create substantial triage effort. We study whether CodeQL false positives in Java security analysis form recurring, explainable patterns that can be reduced by refining the analysis. We run CodeQL's Java security query...
arXiv:2609.04495v1 Announce Type: cross
Abstract: We formulate indirect prompt injection as a test-time search over a task-dependent attack surface induced by the environment, user task, and injection task. To operationalize this formulation, we introduce an agentic attacker with a dedicated search harness that performs environment reconnaissance, structured reasoning over attack strategies, and...
arXiv:2609.05380v1 Announce Type: new
Abstract: Ensuring security of software supply chains (SSC) is indispensable in today's world of modern software practices. SBOM (tools) have been introduced as relevant building blocks to ensure the transparency of SSCs. However they have serious limitations in practices as their vulnerability detection and interpretation capacity is not sufficient to...
arXiv:2609.05370v1 Announce Type: new
Abstract: Decompilation recovers high-level source from compiled machine code and serves as a foundation for security tasks such as vulnerability detection and malware analysis. Traditional decompilers like Ghidra and Hex-Rays expose whatever they cannot resolve as visible placeholders and often emit pseudocode that will not compile or execute; LLM-based...
arXiv:2609.05335v1 Announce Type: new
Abstract: Public vulnerability databases collect rich information about known software flaws, including their weakness types, affected components, and related patches. Fixing commits provide the exact code changes that removed these flaws. While these records capture why the original code was unsafe, they are documented mainly for human inspection rather...
arXiv:2609.05329v1 Announce Type: new
Abstract: Machine unlearning typically aims to emulate retraining from scratch: upon a deletion request, the unlearning algorithm should produce an outcome that would have been obtained had the deleted point never been included. Recent work has shown that this emulation requirement carries no meaningful privacy semantics against an adversary who observes a...
arXiv:2609.05269v1 Announce Type: new
Abstract: LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross...
arXiv:2609.05236v1 Announce Type: new
Abstract: Employees are increasingly using personally owned generative AI tools such as ChatGPT, Gemini, and Claude for their daily work. This practice is known as Bring Your Own AI (BYOAI), which is a distinct form of Shadow AI in which employee-authenticated personal accounts are used outside of enterprise identity and security controls. Existing...
arXiv:2609.05165v1 Announce Type: new
Abstract: Despite its introduction more than a quarter century ago, Conformal Prediction (CP) has seen surprisingly few applications to the cyber security world thus far. In particular, we observe that, while CP has been employed as a defensive measure in many recent works, its use for carrying out attacks (i.e., for offensive security) is hard to trace in...
In modern AI ecosystems, specialized data providers (e.g., Cyber Threat Intelligence, legal, or medical firms) often license their proprietary corpora to third-party RAG (Retrieval-Augmented Generation) operators. A significant economic risk arises when these operators "free-ride"—caching or reusing licensed data without proper compensation. Because LLMs paraphrase content and mix multiple...
Large language models (LLMs) are vulnerable to jailbreak attacks that bypass safety alignment through carefully crafted prompts. Many existing defenses require access to model weights or internals, making them difficult to apply to black-box deployments. We propose AlcaTRAz (Anchored Tree-Rule defense Against jailbreaks), a promptlevel defense based on rule trees that operates exclusively on the...
The Musical Metaverse (MM) is a specialized subset of the Metaverse requiring ultra-low latency (typically <30ms) to enable real-time collaborative musical performance. This extreme requirement, combined with the collection of highly sensitive multimodal data (audio, motion, and neurophysiological signals), creates a unique threat landscape where traditional security protocols often fail due to...
Post-quantum signature migration poses a distinct systems problem when authorization is distributed among multiple parties. In native threshold signing, the signature algorithm may determine key generation, share state, preprocessing, interaction, combination, refresh, and recovery. Architectures that evaluate threshold policy outside the native signing relation can reduce this coupling, but...