Multi-agent LLM reaches 79% on penetration testing benchmarks
Fine-tuned model drives agents through reconnaissance, scanning, and exploitation without human input on standard tests
cs.CR
Cryptography and Security
Covers all areas of cryptography and security including authentication, public key cryptosytems, proof-carrying code, etc. Roughly includes material in ACM Subject Classes D.4.6 and E.3.
sort pith recommended most recent
Agent memory security starts at write time
A lifecycle map shows why provenance and versioning must be built in from the first store.
Benchmark shows frequency cues trace deepfake edit sequences
SEED dataset of 90K sequentially edited images finds high-frequency wavelets help order manipulations even after degradation
· “SEED: A Large-Scale Benchmark for Provenance Tracing in Sequential Deepfake Facial Edits”
Short VDF delays fail economic security tests for randomness beacons
Rational attackers profit by accelerating hardware to capture MEV, so delays must exceed cost-based thresholds derived from an optimal-stop
· “Economic Security of VDF-Based Randomness Beacons: Models, Thresholds, and Design Guidelines”
Physical rim cuts ALPR accuracy by 60 percent
Street-legal attachment reaches 18 percent impersonation rate for under 100 dollars without altering plates
· “Street-Legal Physical-World Adversarial Rim for License Plates”
Self-referenced check catches RAG poison at 95% AUROC
Query-time and corpus-time filters cut attack success from 67% to 14% while clean QA utility stays put.
Reconnaissance lifts prompt-injection attack success by 67 points
Knowing the agent's tools and task before injecting beats payload-only red teaming across models and benchmarks.
· “Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents”
1,646 vulnerability records show fixes span multiple patches
A new taxonomy of why patches fail and why current detection tools score below chance at spotting incomplete fixes.
Chatbot prompts can be rewritten to block profiling without killing answers
A local agent chooses redaction, abstraction, replacement, or decoy noise so providers see less and users still get useful replies
RogueMerge formulates model-merging attacks as a stochastic min-max problem solved with…
RogueMerge jointly optimizes for post-merge success and uses a Taylor approximation to handle unknown weights and new prompts.
· “RogueMerge: Robust and Unified Attacks against LLM Model Merging”
Hybrid verifier grounds LLM guesses to rebuild attack paths
Generator proposes links; symbolic checks on surviving telemetry cut hallucinations to 6 percent while preserving 84 percent precision after
· “HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics”
LLMs generate bypass rules that succeed on 79% of malware samples
Execution trace analysis lets models create YARA rules that reveal hidden behaviors and classify 47% more families than standard platforms.
· “A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox”
Binomial encoding embeds every payload bit at every LLM token
Stateful redirection keeps 64-bit messages recoverable with little change to the generated text
· “Every Bit, Everywhere, All at Once: A Binomial Multibit LLM Watermark”
ShadowMerge poisons graph memory via shared relation channels
Conflicting relations merge into the same anchor as benign data, letting attackers steer agent answers on targeted tasks at 93.8 percent avg
· “ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts”
Verifier removes 466 non-compliant actions from LLM security plans
Fixed rules and deterministic checker keep baseline recall stable across 200 incidents and three reruns in a financial SOC case study.
· “SOCpilot: Verifying Policy Compliance for LLM-Assisted Incident Response”
Shuffling defense fails to hide Transformer weights in secure inference
Attack aligns permuted activations from ~$1 of queries and recovers weights within low L1 error.
· “On the (In-)Security of the Shuffling Defense in the Transformer Secure Inference”
ICS anonymization resists outliers better than PCA-based SA
Robust scatter matrices deliver stronger privacy at comparable utility when influential outliers are present.
· “Data anonymization in the presence of outliers via invariant coordinate selection”
Gradient coupling certifies detection radius for memory poisoning
Any continuous evasion attempt must degrade retrieval performance, supplying guarantees independent of attacker strategy
· “MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents”
Benchmark rates security agents at 97% true positive detection
SIR-Bench replays real incidents to test if agents discover new evidence or merely echo alerts.
· “SIR-Bench: Evaluating Investigation Depth in Security Incident Response Agents”
Twin-field QKD secures blockchain with linear scaling
Hybrid architecture uses MDI star topology to integrate information-theoretic security into distributed consensus.
MESSALA LLM matches veteran SOC analysts on report scores
Framework adds practitioner checklist and multi-perspective checks to give closer evaluations and concrete fixes.
DualGuard defends LLM watermarks from paraphrase and spoofing
Dual-stream signals based on semantics detect and trace attacks while preserving text quality.
Frequency tweaks let synthetic tables carry detectable marks
Adjusting imaginary DFT parts after normalization embeds signals that survive attacks without storage costs or loss of data utility.
No human needed: LLM agents hack a corporate AD lab for ~$23
Reasoning models beat standard ones roughly 5 to 1 on accounts compromised, at ~$23 per two-hour run.
Spotlighting cuts indirect prompt injection success to under 2%
Transformations mark input origins so models follow only trusted commands while keeping task performance nearly unchanged.
· “Defending Against Indirect Prompt Injection Attacks With Spotlighting”
General adversaries make consensus pay an n^{1/d} tax
Projective-geometry adversary families lift the Ω(Ln) baseline to Ω(L n^{1+1/d}) bits for agreement and broadcast.
· “Multivalued Consensus: General Adversaries Require More Communication”
Proofs of space escape the random oracle model
Derandomization hardness plus succinct arguments forces a cheating prover to store nearly every bit.
Reverse engineering finds six flaws in AirDrop and Quick Share
Protocols on over five billion devices accept complex untrusted data without pairing, exposing reachable denial-of-service and bypass paths.
Generalized Thresholding Mechanism tests DP mechanisms near-optimally
It accepts the first sufficiently successful mechanism from a sequence, rejects the rest, and uses a bounded number of evaluations while保持纯ε
All 119 tested MCP OAuth servers show authentication flaws
First study of real-world remote servers finds 325 total issues, dynamic client registration flaws in 96.6 percent.
· “A First Measurement Study on Authentication Security in Real-World Remote MCP Servers”
Edge AI chips let apps bypass OS security on 100M devices
Six of seven tested accelerators from major vendors allow malicious apps to perform privileged operations.
· “Speed Kills: Exploring Confused Deputy Attacks Through Edge AI Accelerators”
Privacy audits need no retraining runs
Fixed member and non-member datasets plus two corrections for distribution shift produce valid privacy bounds.
Nearly 39% of LLM defense sequences worsen original risks
Sequential patching without retraining creates order-dependent conflicts that reverse prior protections in shared layers.
· “Defenses at Odds: Measuring and Explaining Defense Conflicts in Large Language Models”
Diffusion models uncover semantic attacks on vehicle maps
Attacks using shadows or wet roads suppress 57% of detections and inject false boundaries where pixel methods fail entirely.
· “Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion”
LLM agents crash V8 but rarely execute arbitrary code
ExploitBench measures 16 progressive flags on 41 V8 vulnerabilities and finds public models stop at crashes while private models reach code
· “ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents”
Transfers disguised as ordinary DeFi losses evade tracing
Staging them as MEV events like sandwiches or arbitrage leaves sender and receiver unlinked under standard tools.
· “Extending Blockchain Untraceability with Plausible Deniability”
Thermal cameras fingerprint VR apps remotely
Chassis heat patterns identify applications at over 90 percent accuracy from a meter away using 10 seconds of data.
· “ThermalTap: Passive Application Fingerprinting in VR Headsets via Thermal Side Channels”
AI agent automates red teaming workflows in hours
Natural language goals drive attack selection and composition, unifying tests for ML and generative models with high success rates in case演示
· “Redefining AI Red Teaming in the Agentic Era: From Weeks to Hours”
One-page attack skill beats trajectory retrieval at red-teaming
An evolving attack playbook outperforms fixed jailbreaks and agentic baselines while using fewer tool calls.
· “RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution”
Perfect F1 score hides a 50 percent blind spot in model scanners
A benchmark shows why security-scanner accuracy and availability must be reported separately.
· “Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners”
Tool-level attacks become user-authorized in all six harnesses
Delegation, goals, and scheduled tasks relabel attacker content as user intent, defeating both the model and permission review.
· “When Context Gets Root: Privilege Escalation in LLM Harnesses”
Lowering a backdoor's success rate hides it from four defenses
A reverse-trained backdoor hides its trigger signal but keeps target bias and evades detection.
· “Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry”
Deployed Rowhammer defense fails in ~1 second
A round-robin attack across sub-banks cuts mean time to failure from 13 years to about 1 second.
· “From Fleet to Lab: Revisiting the Security and Complexity of Industrial Rowhammer Mitigation”
Teacher-student scrub cuts RTL backdoor success to as low as 12%
One epoch of clean-data fine-tuning, no triggers needed, keeps functional correctness and often lifts pass rates.
· “RTLGuard: A Lightweight Teacher-Student Defense for Poisoned RTL Code Generation Models”
Renaming identifiers sabotages code search: rankings drop 77 points
An attack built on a small open model transfers to closed-source embedders and LLMs.
· “Vulnerable Code Search: Transferable Attack for Code Language Models”
Jailbreak defense cuts attack success to near zero after round one
It stores the attack method, not the topic, and applies that knowledge to future inputs with no parameter updates.
· “A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks”
Same Office file: one truth in Excel
Even specification-valid documents can show a benign value in Office while an extractor feeds a planted trap fact to the model.
· “Beyond the Editing Canvas: Evidence Divergence in OOXML-to-LLM Ingestion”
One tool flags tiny buttons and risky links in Mini-Programs
Visual AI checks 44-pixel tap targets; a proxy scores the URLs those clicks trigger.
· “A Hybrid Security Framework for Mini-Programs: Visual UI Compliance and Network Risk Assessment”
One prompt-space skill cuts agent malware severity 3.37 to 0.58
Retraining-free defense for API-only agents: execution attack success drops to 14.5 percent with a per-class skill.
· “SkillShield: Prompt-Space Security Skills for LLM Coding Agents”
99% of internal Dockerfiles harbor security flaws
The fix already exists: most workload clusters contain a secure reference; copying it lifts scores 60.4%.
Self-evolving agents re-author planted malware into new skills
One retrieval can seed a worm of agent-written copies that survives removal of the original malicious skill.
Valid AP2 signatures alone don't prove user intent
Five demonstrations show context manipulation before signing makes every mandate valid but unintended.
· “Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)”
RSA quantum risk crosses 50% by 2030-2032
A reproducible scenario model separates mechanism-backed RSA risk from conditional PQC risk, with updateable dates for migration planning.
Rowhammer backdoors that hold up across DRAM chips
The attack maps model weights onto a chip's real bit-flip sites, reaching near 90 percent success.
· “ROBBIN: Rowhammer-Based Backdoor Injection during Inference”
Benign-first MCP attacks fool AI agents 69.5% of the time
Zero-oracle SHIELD defense cuts it to 42.7%, but no frontier model is robust to staged server compromise.
· “TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers”
Host-only kernel monitor catches pivot attacks in real time
Stitch links incoming and outgoing flows via process labels on one host, cutting false positives below 0.01 percent.
· “Effective Pivot Attack Detection via System and Network Information”
Only 4–16% of CLAUDE.md security rules have a matching control
Most written rules stay prose for the model to interpret; nothing marks which rules are enforced.
· “When "Do Not" Is Not Deny: Security Rules in CLAUDE.md vs Built-In Controls”
Clean-data scores won't predict which ICS detectors survive poisoning
On the SWaT water plant, 1% poisoned training data crushes top clean detectors while PCA and SVM hold.
Frozen encoder learns new malware classes from five packets
Rehearsal-free framework hits 61% final-session accuracy and halves forgetting
· “Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition”
One planted message hijacks an agent's later answers
No memory access needed: one injected page steers Qwen2.5 answers 76.6% of the time once retrieved.
· “InjecMEM: Memory Injection Attack on LLM Agent Memory Systems”
Injected rules beat flattening for relational anomaly detection
On cybersecurity events and two e-commerce churn tasks, rule-aware graphs rank rare anomalies best.
Blockchain liveness comes down to validator-graph connectivity
If the validator graph survives any f failures, encrypted sensor data keeps flowing; otherwise it halts.
Privacy bound beats prior work and covers noise-free encoders
A spectral trace-of-inverse bound stays nontrivial for deterministic encoders and covers perceptual metrics.
· “Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding”
Adversarial prompts cut weight-exfiltration defense from 200x to 60x
Garbled, script-mixed prompts roughly double leaked bits per token, so static jitter thresholds understate exfiltration risk.
· “Adversarial Entropy Inflation Against Gumbel-Based Inference Verification”
Trusted apps can reprogram the SSD's FTL at 3.74% overhead
A new meta-interface lets trusted administrators install on-device storage policies even when the OS is hostile.
· “SxSSD: A Secure and Extensible Software-defined Solid State Drive”
5G-embedded monitoring certifies IoT devices continuously
Eight automated tests map pass/fail verdicts to CRA and NIS2 rules, with under 10 ms added latency.
· “CERTIoT-6G: Continuous Cybersecurity Certification for IoT Devices in 5G/6G Networks”
2 of 40 LLM strategies beat buy-and-hold: consistency is not edge
FIDES reconciles what a model says, codes, and earns: 32 strategies claimed market-beating edge, one delivered it.
· “FIDES: A Concordance Protocol for LLM-Generated Trading Strategies”
67,502 raw scans capture phishing sites before they vanish
Raw HTML, screenshots, TLS, and DNS stay inspectable so researchers can re-derive features as phishing evolves.
· “PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research”
Probing bot recovers 72.8% of attack techniques in underground chats
Eleven agents turn passive forum watching into targeted questioning and pull out extra threat intelligence.
· “Towards Automated Cyber Threat Intelligence Elicitation in Underground Forums”
ML-built graphs expose cipher weaknesses at zero false positives
All three models identify high-probability differentials with no false positives in SIMON and SIMECK.
· “Graph Representation Learning of Lightweight IoT Ciphers”
Public traces shrink shielded-coin anonymity sets by 40–59%
Non-heuristic analysis of Railgun and Hinkal finds thousands of withdrawals with ten or fewer possible source addresses.
· “The Anonymity Gap: Understanding Real Privacy in Shielded UTXO-based Protocols for DeFi”
When attackers need a payoff
The paper turns the "no positive-utility attack" test into model checking, with computable thresholds for payments and voting.
NIC EM leakage identifies eight network behaviors at 80.67% F1
A passive probe near the NIC tells benign web use from floods, scans, and probes without packet or host access.
Agent edit safety decided exactly: all safe paths
A runtime derives from its execution record what a checkpoint, fork, restore, or merge must preserve, making safety exact.
· “When Can Agents Safely Checkpoint, Fork, Restore, and Merge? Exact Checking for Execution Edits”
Quantum attackers could drain ~6.9M BTC and most Solana accounts
A new review maps the crypto value exposed to Shor's algorithm and the post-quantum upgrades already being tested.
· “Cryptocurrencies in the Quantum Age: Migration Paths to PQC”
This paper shows that when an AI system samples many candidate responses
In constrained Best-of-N sampling, unsafe outputs that pass a learned safety filter can dominate selection when they have heavier reward…
· “Safety Hacking in Constrained Best-of-N Inference-time Scaling”
Verified LLM rules catch 81.5% of IoT attacks
Synthesizing semantic specs with an LLM and verifying them against benign traffic beats one-shot rule generation.
AgentFlow is a policy layer for AI agents that tracks where sensitive or untrusted data…
AgentFlow enforces flow and path policies over labeled data edges in LLM agent systems, reporting 0% confirmed compromise on AgentDojo and…
· “AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems”
DIME is a new membership inference attack for diffusion models that combines two signals…
A query-efficient membership inference attack for diffusion models, DIME, derives a test statistic from the optimal denoiser's…
· “DIME: Query-Efficient Framework for Membership Inference on Diffusion Models”
NFT soft pairing splits Bluetooth pairing from service access
A blockchain token binding decides who may use a device, so access expires and revokes without touching the Bluetooth stack.
· “A Study of Bluetooth Access Control Based on NFT Soft Pairing”
