Empirical analysis of 444 iOS apps using dynamic traffic interception found 282 leaking LLM API keys across ten providers, with only 28% remediation after three months.
hub Canonical reference
In: IEEE Symposium on Security and Privacy (S&P)
Canonical reference. 92% of citing Pith papers cite this work as background.
48
Pith papers citing it
50
external citations · external index
Background
92% of classified citations
hub tools
citation-role summary
background 12
baseline 1
citation-polarity summary
representative citing papers
The first systematization of reconstruction attacks on synthetic tabular data finds that generator choice dominates privacy risk over attack choice, with differential privacy effective only at low budgets and most leakage reflecting population structure rather than memorization.
Prismata cuts web-agent prompt-injection attack success from 85.5% to 0.7% via Biba-inspired DOM trust labeling and mechanical least-privilege confinement without site annotations.
Infinite agentic loops are a distinct failure mode in LLM agents arising from unbounded feedback paths, and IAL-Scan detects them via framework-independent static analysis with 91.9% precision on 6,549 repositories.
AgentFlow builds a framework-agnostic Agent Dependency Graph from agent program source code to support static analyses such as BOM generation and prompt-to-tool risk detection, evaluated on 5,399 real programs across five frameworks.
MHOT achieves provably minimal tree height via discriminative-bit indexing and hierarchical proofs, delivering up to 9X write throughput, 4X lower amplification, 2X smaller proofs, and 0% Nurgle attack success versus MPT on Ethereum workloads.
Formulates privacy-constrained advertising measurement as a robust causal decision problem under signal loss and derives a sharp decision frontier separating certifiable from unresolved incrementality claims.
PACZero achieves zero mutual information privacy in LLM fine-tuning via sign-quantized subset-aggregated ZO gradients, delivering near non-private accuracy on SST-2 at I=0.
A low-stake adversary can degrade a liquid staking pool's performance via consensus manipulation and profit from the resulting drop in its LST value through application-layer financial positions.
zkComposer decomposes monolithic zkML proofs into parallel sub-proofs linked by shared boundary commitments, yielding up to 6.84× lower prover time on GPT-2 without new cryptographic primitives.
Post-processing fairness methods (ROC and EqOdds) provide the most stable fairness-utility trade-offs when training classifiers on DP synthetic tabular data, outperforming pre- and in-processing interventions.
Traffic-CBM classifies encrypted traffic through a hierarchically organized 18-concept representation tied to evidence groups, remaining competitive with black-box models while enabling concept-level explanation.
Cond-DP conditions DPSGD on public features with decaying spectra to achieve faster convergence guarantees and better empirical performance in label-DP regression.
ResAware improves cross-environment website fingerprinting robustness by distilling resource-privileged knowledge into a traffic-only student model, raising Var-CNN F1 from 72.77% to 81.49% under 150-day drift on a 160k-sample dataset.
Embedding and removing a dummy backdoor reduces unknown backdoor success in generative LLMs by targeting shared trigger-activated internal mechanisms.
DNS over CoAP with packet length equalization, block-wise transfer, header and payload compression reduces DNS identification accuracy to 77-86% in constrained IoT scenarios, outperforming DNS over HTTPS.
TraceCodec is a compiler-backed neural codec that lifts packets to state-aware action latents for high-fidelity multi-flow trace generation, matching real traces within 0.03% on CICIDS2017.
A systematic review of on-device AI inference security finds defenses are imbalanced, with roughly half focused on IP theft while one-third of attacks (adversarial examples) lack any associated defenses.
PoisonCap uses a new poison capability format to deliver strict use-after-free and initialization safety for CHERI systems with no fundamental overhead over Cornucopia baselines.
An automated static-analysis pipeline generates labeled structural units from virtualization-obfuscated binaries so LLMs can analyze them without exceeding token limits.
Current AI image watermark removal attacks replace the watermark with a different forensic signal, allowing independent detectors to distinguish processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget.
GRASP detects anomalies in system provenance graphs via self-supervised executable prediction from two-hop neighborhoods, outperforming prior PIDS on DARPA datasets by identifying all documented attacks where behaviors are learnable plus additional unlabeled suspicious activity.
Metaphors scaffold youth privacy reasoning and design, with relational metaphors potentially increasing disclosure by framing systems as loyal companions.
Pomegranate compartmentalizes commodity OS kernels via virtualization extensions, sentry functions, and EPT-enforced policies, achieving negligible overhead on a Linux network stack when compartment boundaries limit cross-talk.
citing papers explorer
-
Mind your key: An Empirical Study of LLM API Credential Leakage in iOS Apps
Empirical analysis of 444 iOS apps using dynamic traffic interception found 282 leaking LLM API keys across ten providers, with only 28% remediation after three months.
-
SoK: Reconstruction Attacks on Synthetic Tabular Data (Insights from Winning the NIST CRC)
The first systematization of reconstruction attacks on synthetic tabular data finds that generator choice dominates privacy risk over attack choice, with differential privacy effective only at low budgets and most leakage reflecting population structure rather than memorization.
-
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Prismata cuts web-agent prompt-injection attack success from 85.5% to 0.7% via Biba-inspired DOM trust labeling and mechanical least-privilege confinement without site annotations.
-
When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents
Infinite agentic loops are a distinct failure mode in LLM agents arising from unbounded feedback paths, and IAL-Scan detects them via framework-independent static analysis with 91.9% precision on 6,549 repositories.
-
AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs
AgentFlow builds a framework-agnostic Agent Dependency Graph from agent program source code to support static analyses such as BOM generation and prompt-to-tool risk detection, evaluated on 5,399 real programs across five frameworks.
-
MHOT: Height-Optimized Authenticated Data Structure for Blockchain State Commitment
MHOT achieves provably minimal tree height via discriminative-bit indexing and hierarchical proofs, delivering up to 9X write throughput, 4X lower amplification, 2X smaller proofs, and 0% Nurgle attack success versus MPT on Ethereum workloads.
-
Privacy-Robust Incrementality Measurement for Advertising Systems under Signal Loss
Formulates privacy-constrained advertising measurement as a robust causal decision problem under signal loss and derives a sharp decision frontier separating certifiable from unresolved incrementality claims.
-
PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization
PACZero achieves zero mutual information privacy in LLM fine-tuning via sign-quantized subset-aggregated ZO gradients, delivering near non-private accuracy on SST-2 at I=0.
-
Your Loss is My Gain: Low Stake Attacks on Liquid Staking Pools
A low-stake adversary can degrade a liquid staking pool's performance via consensus manipulation and profit from the resulting drop in its LST value through application-layer financial positions.
-
zkComposer: Decomposing Proof Construction to Scale zkML
zkComposer decomposes monolithic zkML proofs into parallel sub-proofs linked by shared boundary commitments, yielding up to 6.84× lower prover time on GPT-2 without new cryptographic primitives.
-
Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data
Post-processing fairness methods (ROC and EqOdds) provide the most stable fairness-utility trade-offs when training classifiers on DP synthetic tabular data, outperforming pre- and in-processing interventions.
-
Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification
Traffic-CBM classifies encrypted traffic through a hierarchically organized 18-concept representation tied to evidence groups, remaining competitive with black-box models while enabling concept-level explanation.
-
Private Learning with Public Feature Conditioning
Cond-DP conditions DPSGD on public features with decaying spectra to achieve faster convergence guarantees and better empirical performance in label-DP regression.
-
ResAware: Cross-Environment Website Fingerprinting via Resource-Privileged Distillation
ResAware improves cross-environment website fingerprinting robustness by distilling resource-privileged knowledge into a traffic-only student model, raising Var-CNN F1 from 72.77% to 81.49% under 150-day drift on a 160k-sample dataset.
-
Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs
Embedding and removing a dummy backdoor reduces unknown backdoor success in generative LLMs by targeting shared trigger-activated internal mechanisms.
-
Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT
DNS over CoAP with packet length equalization, block-wise transfer, header and payload compression reduces DNS identification accuracy to 77-86% in constrained IoT scenarios, outperforming DNS over HTTPS.
-
TraceCodec: A Compiler-Backed Neural Codec for Stateful Multi-Flow Network Traffic Traces
TraceCodec is a compiler-backed neural codec that lifts packets to state-aware action latents for high-fidelity multi-flow trace generation, matching real traces within 0.03% on CICIDS2017.
-
Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms
A systematic review of on-device AI inference security finds defenses are imbalanced, with roughly half focused on IP theft while one-third of attacks (adversarial examples) lack any associated defenses.
-
PoisonCap: Efficient Hierarchical Temporal Safety for CHERI
PoisonCap uses a new poison capability format to deliver strict use-after-free and initialization safety for CHERI systems with no fundamental overhead over Cornucopia baselines.
-
Towards LLM-Based Analysis of Virtualization-Obfuscated Code through Automated Data Generation
An automated static-analysis pipeline generates labeled structural units from virtualization-obfuscated binaries so LLMs can analyze them without exceeding token limits.
-
Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal
Current AI image watermark removal attacks replace the watermark with a different forensic signal, allowing independent detectors to distinguish processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget.
-
GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification
GRASP detects anomalies in system provenance graphs via self-supervised executable prediction from two-hop neighborhoods, outperforming prior PIDS on DARPA datasets by identifying all documented attacks where behaviors are learnable plus additional unlabeled suspicious activity.
-
Metaphors as Scaffolds: Spatial, Embodied, Fantastical, and Relational Framings for Youth Usable Privacy Design
Metaphors scaffold youth privacy reasoning and design, with relational metaphors potentially increasing disclosure by framing systems as loyal companions.
-
Pomegranate: A Lightweight Compartmentalization Architecture using Virtualization Extensions
Pomegranate compartmentalizes commodity OS kernels via virtualization extensions, sentry functions, and EPT-enforced policies, achieving negligible overhead on a Linux network stack when compartment boundaries limit cross-talk.
-
Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis
Semia synthesizes Datalog representations of agent skills via constraint-guided loops to enable reachability queries for semantic risks, finding critical issues in over half of 13,728 real skills with 97.7% recall on expert-labeled samples.
-
Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers
BadStyle creates stealthy backdoors in LLMs by poisoning samples with imperceptible style triggers and using an auxiliary loss to stabilize payload injection, achieving high attack success rates across multiple models while evading defenses.
-
Differentially Private Modeling of Disease Transmission within Human Contact Networks
A differentially private pipeline using node-level DP summaries to fit ERGMs or SBMs, generate synthetic networks, and simulate SIS disease spread on ARTNet sexual contact data produces incidence, prevalence, and intervention effect sizes close to non-private versions.
-
PrivacyAkinator: Articulating Key Privacy Design Decisions by Answering LLM-Generated Multiple-choice Questions
PrivacyAkinator uses LLM-generated questions grounded in data-flow representations and a news-mined design space to help developers surface privacy decisions, yielding 47% more decisions identified in 73% less time than PRAM in a 24-person study.
-
Content Fuzzing for Escaping Information Cocoons on Digital Social Media
ContentFuzz rewrites posts with LLM guidance from stance model confidence to flip machine labels without altering human intent, tested across four models and three datasets in two languages.
-
NanoTag: Systems Support for Efficient Byte-Granular Overflow Detection on ARM MTE
NanoTag enables byte-granular overflow detection on unmodified MTE binaries by combining hardware tagging with selective software tripwire checks on the Scudo allocator.
-
Ambulance: saving BFT through racing
Ambulance uses protocol-rigged races among replicas to achieve high throughput and low latency comparable to timeout-based BFT while matching the robustness of cooperative approaches.
-
TinyContainer: Container Runtime Middleware Enabling Multi-tenant Microcontrollers with Built-in Security
TinyContainer provides per-container configurable scheduling and fine-grained access control for multi-tenant microcontrollers with up to 4 ms overhead per call.
-
Can Crowdsourcing Survive the LLM Era? A Community Survey on Human Data Collection
Survey of 155 researchers finds 44% observed LLM usage in crowdsourced data, with high awareness but insufficient mitigation efforts.
-
AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasing
AliMark introduces a two-stage detection strategy with multi-candidate bit sequence alignment to improve robustness of sentence-level text watermarks against paraphrasing attacks.
-
Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals
Prompt injection detection performance is highly regime-dependent with no single detector dominating across settings; transformer models perform best overall while structural signals offer modest gains in some regimes.
-
Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions
A lifecycle-based survey of LLM fine-tuning security that reviews attacks and defenses by intervention phase and reports unified empirical findings on model-dependent attack effectiveness and limited defense generalization.
-
Adversarial Reframing: A Framework for Targeted Generation in Language Models
THREAT uses coordinated LLMs in an iterative optimization loop to generate jailbreak prompts that achieve higher success rates and lower detection rates than previous methods across tested models and datasets.
-
An Evaluation of Chat Safety Moderations in Roblox
Roblox's automated chat moderation fails to catch numerous unsafe messages involving grooming, sexualization of minors, bullying, violence, self-harm, and sensitive information sharing, with users evading detection through various techniques.
-
Position Paper: Denial-of-Service against Multi-Round Transaction Simulation
The paper examines denial-of-service risks to multi-round transaction simulation arising from inter-transaction dependencies in smart-contract state.
-
How Generative AI Empowers Attackers and Defenders Across the Trust & Safety Landscape
Generative AI boosts attackers' ability to create harmful content at scale while also enabling defenders to detect threats, support users, and improve moderation processes.
-
Certification of Machine Learning Models via Directional Sharpness
Directional sharpness is introduced as a metric that correlates more strongly with generalization, identifies poor generalization more reliably, and supports efficient auditing and zero-knowledge certification.
-
Agent Security is a Systems Problem
The paper argues that agent security is best addressed as a systems problem by applying principles from operating systems, networks, and formal methods rather than relying solely on model robustness improvements.
-
AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Comprehensive Survey
A literature survey synthesizes 119 studies on AI-driven alert screening into a four-stage taxonomy of filtering, triage, correlation, and generative augmentation while identifying gaps in deployment realism and robustness.
-
Digital Guardians: The Past and The Future of Cyber-Physical Resilience
A survey frames CPS resilience through five themes and illustrates them in connected transportation and medical systems to provide a roadmap for real-world resilience.
-
StegoStylo: Squelching Stylometric Scrutiny through Steganographic Stitching
A single run on a nine-word sentence suggests that injecting zero-width Unicode characters into 33% of words drops a stylometry verification score below the attribution threshold.
- GapFuzz: Cross-Plane Divergence Fuzzing for Distributed SDN Controllers
- The Price of Decentralization in Block Building
- To Wait or To Probe: Arbitrage Competition on High-Throughput Blockchains