|_Keywords_:<br>Digital twin<br>ICS<br>ATT&CK for ICS<br>LLMs<br>RAG<br>Attack graphs<br>Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry<br>is difcult because process observations reveal physical changes more directly<br>than the actions that produced them. This paper presents a Digital Twin (DT)-<br>assisted framework that extracts synchronized state changes,...
Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale. Todays software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software. Along this line, our study of agent trajectories in vulnerability analysis shows a...
arXiv:2610.20567v1 Announce Type: cross
Abstract: Cloud services rapidly shift towards independently-managed microservices architectures. This independence may lead to temporary microservices miscoordination, resulting in overloads and rejections of valuable transactions. This weakness may further be exploited by attackers to launch overload attacks inflicting performance and cost damages....
arXiv:2610.20537v1 Announce Type: cross
Abstract: Side-channel attacks on block ciphers rarely recover the key outright: they leave a residual key space ordered by subkey posteriors, and evaluation laboratories report the key rank of the true key against thresholds near 2^48 and 2^60. No evaluation framework models an adversary who collects traces classically and finishes the search on a quantum...
arXiv:2610.20437v1 Announce Type: cross
Abstract: Mid-2026 reporting on autonomous AI evaluation incidents claimed that frontier large language model (LLM) agents escaped server containment through emergent coordination and cloud infrastructure attacks. This paper contextualizes those claims through forensic analysis and containerized recreation of both the Highly Persistent Internal Model...
arXiv:2610.20055v1 Announce Type: cross
Abstract: The rapid advancement of large vision language models (LVLMs) has made geolocation inference from images highly accurate and accessible. This poses serious privacy risks: a passive adversary with black-box LVLM access can infer a user's location from a single photo with no metadata. Existing protection methods rely almost exclusively on...
arXiv:2610.19717v1 Announce Type: cross
Abstract: Recent advances in diffusion models have enabled high-fidelity, identity-preserving image generation for personalized applications such as digital avatars and virtual try-on systems. However, their reliance on sensitive facial reference images raises growing privacy concerns. Existing defense mechanisms are primarily designed for training-based...
arXiv:2610.19335v1 Announce Type: cross
Abstract: Sequential data such as documents, conversations, and trajectories are naturally partitioned across users, motivating privacy guarantees that protect each user's entire trajectory. We initiate the study of privately estimating the transition matrix of a discrete ergodic Markov chain from N independent trajectories of length T, with arbitrary...
arXiv:2610.19306v1 Announce Type: cross
Abstract: Jailbreak attacks against large language models (LLMs) are evaluated using attack success rate (ASR), which depends on correctly identifying responses that fulfill prohibited requests. Existing evaluators can mistake refusals or topically related responses for successful attacks. We show that changing only the judge LLM can alter reported ASR by...
arXiv:2610.19158v1 Announce Type: cross
Abstract: LLM agents are becoming increasingly capable of handling daily workspace tasks by interacting with application environments through tool calls. However, as agents read and write sensitive user data across email, documents, and other applications, a central privacy question is whether they preserve contextual integrity (CI), that is, whether the...
arXiv:2610.18934v1 Announce Type: cross
Abstract: Conventional deepfake speech detectors primarily target synthesis artifacts and often degrade under unseen attacks or recording conditions. Human speech, however, contains physiological markers associated with respiration, phonation, and temporal coordination arising from the speech-production system that synthesizers may not reproduce...
arXiv:2610.20521v1 Announce Type: new
Abstract: We present Tulva, a practical threshold FHE scheme which equips a base FHE scheme with an asynchronous threshold decryption mechanism in a modular way. Our scheme simultaneously (1) is compatible with virtually any base FHE scheme and leaves its ciphertexts unchanged apart from an appended random tag, (2) supports a wide range of threshold profiles...
arXiv:2610.20427v1 Announce Type: new
Abstract: Detecting unseen malware variants remains a major challenge as malware families continuously evolve. This issue is exacerbated in data-scarce scenarios such as emerging malware campaigns, where only a few samples are available to train robust detectors. A common strategy is to proactively generate malware variants and use them as augmentation data...
arXiv:2610.20315v1 Announce Type: new
Abstract: Background: Rust is a modern programming language known for its focus on usability, concurrency, and security. However, empirical studies reveal that Rust is still affected by software vulnerabilities, with hundreds of memory safety issues found in Rust programs, including Rust's standard library. As a result, additional tool-assisted security...
arXiv:2610.20284v1 Announce Type: new
Abstract: High-quality data is essential for improving instruction tuning in threat intelligence analysis. However, existing methods for generating cybersecurity instruction data lack reliable quality assessment mechanisms, and gradient influence-based data selection methods primarily focus on single-sample matching, failing to cover diverse and complex...
arXiv:2610.20245v1 Announce Type: new
Abstract: Large language models are increasingly deployed as autonomous agents for automated program repair, patching software vulnerabilities through multi-step reasoning and tool use. Yet these systems typically validate a patch against the same evidence used to construct it -- a static alert, sanitizer trace, published exploit, or test suite. A patch that...
arXiv:2610.20173v1 Announce Type: new
Abstract: Bosley and Dodis (TCC 2007) proved that a class of imperfect randomness sources that suffices for information-theoretic encryption of messages longer than the logarithm of the key length must admit deterministic extraction of nearly uniform bits, and asked whether the same is true of two-out-of-two secret sharing. Aggarwal, Chung, Obremski, and...
arXiv:2610.20171v1 Announce Type: new
Abstract: Constant-time execution is an important security property, especially for IoT devices, that prevents the leakage of sensitive information over timing side-channels. However, achieving constant-time execution is very hard when going down to the cycle level, at least on realistic devices. A lot of research is concerned with producing tools that...
arXiv:2610.20049v1 Announce Type: new
Abstract: Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce...
arXiv:2610.20047v1 Announce Type: new
Abstract: As Internet of Things (IoT) devices collect and process data, security is essential. IoT devices often combine with other emerging technologies, such as artificial intelligence (AI) and fifth-generation (5G) communications, to support applications such as smart grids and internet-of-vehicles (IoV). Because IoT devices are deployed remotely, remote...
arXiv:2610.19971v1 Announce Type: new
Abstract: Automated jailbreak attacks rely on evaluation feedback to optimize adversarial prompts, but existing methods often lack fine-grained diagnostic information. We propose Jev-Guided Strategy Bandit (JSB), a query-based jailbreak framework that leverages multi-dimensional probabilistic feedback to guide prompt optimization. JSB combines continuous...
arXiv:2610.19947v1 Announce Type: new
Abstract: Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured. Existing work often studies only one observable aspect of stealthiness, such as trigger imperceptibility, feature-space separability, parameter-space concentration, or...
arXiv:2610.19898v1 Announce Type: new
Abstract: Bilinear Compressive Security (BCS) is a lightweight encryption scheme that combines compressed sensing with a fresh random convolution filter to improve resistance against key-recovery attacks under key reuse. Previous work derived information-theoretic guarantees for BCS by relating key identifiability to phase retrieval under the assumption that...
arXiv:2610.19856v1 Announce Type: new
Abstract: Typed decision models (TDMs) are increasingly used in applications such as request routing and model selection, making reliable decisions critical to system performance. Fallback options accommodate categories outside regular choices, enabling deferral to human experts or more capable models. While recent works have examined adversarial...
arXiv:2610.19830v1 Announce Type: new
Abstract: Cyber Threat Intelligence (CTI) investigators who monitor dark web marketplaces for leaked credentials and breach listings must pass the diverse CAPTCHAs that operators deploy to block automated collection. Existing solvers either need unscalable per-site fine-tuning or rely on commercial Vision-Language Model (VLM) APIs, which surrender...
arXiv:2610.19766v1 Announce Type: new
Abstract: Although Artificial Intelligence (AI)-based Intrusion Detection Systems (IDSs) are increasingly deployed in operational networks, their dependence on large-scale training data introduces a critical vulnerability to stealthy poisoning attacks. We demonstrate that latent backdoors can be successfully implanted in flow-based IDS models by poisoning as...
arXiv:2610.19650v1 Announce Type: new
Abstract: Understanding the security posture of cyber physical systems (CPS) requires reasoning across both information technology (IT) and operational technology (OT). However, a security analyst often holds an incomplete, role-specific view of the underlying system which has most likely resulted from their knowledge limited by a need-to-know framework....
arXiv:2610.19607v1 Announce Type: new
Abstract: Rising privacy concerns around large language models have accelerated research in private Transformer inference (PTI). Synthesizing the empirical claims in this line of research, however, is hindered by multi-dimensional cryptographic progress and inconsistent evaluation contracts. In this work, we systematize the field by constructing an empirical...
arXiv:2610.19566v1 Announce Type: new
Abstract: Autonomous drones are increasingly deployed in safety-critical tasks, yet their autopilot software can still contain subtle logic flaws that lead to unsafe behaviors. These flaws are difficult to discover with existing techniques because they often depend on semantic relationships across modules, commands, and runtime state, and rarely manifest as...
arXiv:2610.19498v1 Announce Type: new
Abstract: Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current disclosure. We separate the non-environment inputs from the execution environment E and measure a quantity that, to our knowledge, has not been measured...