MalSkillBench supplies the first sandbox-verified dataset of malicious agent skills and shows that existing detectors achieve high recall on code injection but collapse on prompt injection and agent-control attacks.
hub Canonical reference
alien traces
Canonical reference. 76% of citing Pith papers cite this work as background.
61
Pith papers citing it
109
external citations · external index
Background
76% of classified citations
hub tools
citation-role summary
background 17
baseline 2
dataset 1
method 1
citation-polarity summary
representative citing papers
Malicious LLM API routers actively perform payload injection and secret exfiltration, with 9 of 428 tested routers showing malicious behavior and further poisoning risks from leaked credentials.
First systematic security analysis of AI-Apps on pre-trained model hubs identifies five threat categories, ten attack vectors, three novel architectural flaws, and real-world prevalence of credential leaks and injection risks across 970k+ apps.
Giskard is a new protocol using tree-structured log-sized committees and MPC-based approximate median to achieve scalable confidential and Byzantine-robust aggregation in decentralized learning.
VIPIR introduces two new PIR protocols, ExpPack compression, and GPU optimizations for NTT and GEMM that deliver orders-of-magnitude higher throughput than prior systems.
Introduces DelegateCI-Bench (3167 samples) and a CI-guided RL query rewriter that improves privacy-utility tradeoff by up to +10.1 utility over on-device baselines.
Fair fine-tuning under Equalized Odds yields a tight bound Adv(A, M_f) ≤ Δ_EO · W on adversarial advantage in distribution inference attacks, with empirical reductions below detection threshold across six datasets.
Neuroforger generates certified violation witnesses for smart contracts by representing specs as Solidity tests with abstract-type variables, using LLMs to instantiate them, and validating via type checking plus execution.
Conceptual steganography encodes covert information in high-level reasoning patterns within LM chains-of-thought, remaining robust to paraphrase defenses while preserving reasoning utility.
CodeQL detected 171 CVEs total, with 83 caught by a prior version before the fix; detections were often actionable within the vulnerable file but not stable across tool versions.
Zombie domain linkages persist after ownership changes in DNS integrations at rates of 3% in Web PKI, 24% in ENS, and 15% in Maven Central, with validate-once designs accumulating long-term risks while per-use validation prevents them.
A technique for enforcing differential privacy in temporal runtime monitoring by analyzing dependencies and injecting noise into specifications while using tree mechanisms to limit accuracy loss.
A low-stake adversary can degrade a liquid staking pool's performance via consensus manipulation and profit from the resulting drop in its LST value through application-layer financial positions.
Most 'verified' commits on GitHub are automatically signed by the platform's web interface; genuine developer-managed commit signing is rare, inconsistent, and marked by unrevoked expired keys.
COD-ssi enables mutual privacy in SSI credential exchanges by using OPRFs for claim-oblivious disclosure, with formal security verification and a prototype showing moderate overhead.
A sound and complete deductive system for relative trace equality based on relative bisimulation is introduced, formalized in Rocq, and demonstrated on two contract satisfaction proofs.
LLM-based security code review is vulnerable to framing bias, with a novel iterative refinement attack achieving 100% success in reintroducing vulnerabilities across real projects.
Grassroots bonds add maturity dates to local cryptocurrencies to enable lending and other instruments via enforceable digital social contracts.
APIDiffer automatically detects 72 API inconsistencies across 11 Ethereum clients using specification-guided test generation and LLM-based false-positive filtering, with 90% of bugs confirmed by developers.
Introduces the first compositional game-theoretic framework for blockchains using cross-layer games and cross-application composition to analyze incentive compatibility and reveal vulnerabilities in composed systems.
Large-scale analysis of 200K PyPI packages identifies 1,361 replicated popular packages, 256 replicated vulnerable packages, and 7 new replicated malicious packages, showing replication as a security threat vector.
An adaptive crawler using classifier feedback and seed-compound query generation discovers approximately 7.6 times more cumulative unique fake shopping hosts than a fixed-keyword baseline by cycle 3.
ATTAIN is a three-module trace-driven framework that combines exploit execution, LLM-guided diff search, and evidence-based judgment to identify affected library versions for CVEs, reporting 93.24% F1 on 224 CVEs across 25,943 versions.
AttackPathGNN introduces a State Interference Graph and conjunction pooling inside a GNN to detect cross-function vulnerabilities in Solidity contracts, reporting 92.3% F1 on SmartBugs Wild.
citing papers explorer
-
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
MalSkillBench supplies the first sandbox-verified dataset of malicious agent skills and shows that existing detectors achieve high recall on code injection but collapse on prompt injection and agent-control attacks.
-
Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
Malicious LLM API routers actively perform payload injection and secret exfiltration, with 9 of 428 tested routers showing malicious behavior and further poisoning risks from leaked credentials.
-
Your Space is My Zone: Demystifying the Security Risks of AI-Powered Applications on Pre-Trained Model Hubs
First systematic security analysis of AI-Apps on pre-trained model hubs identifies five threat categories, ten attack vectors, three novel architectural flaws, and real-world prevalence of credential leaks and injection risks across 970k+ apps.
-
Giskard : Byzantine Robust and Confidential Aggregation for Large-Scale Decentralized Learning
Giskard is a new protocol using tree-structured log-sized committees and MPC-based approximate median to achieve scalable confidential and Byzantine-robust aggregation in decentralized learning.
-
VIPIR: A Versatile GPU Framework for Integrating Private Information Retrieval Protocols
VIPIR introduces two new PIR protocols, ExpPack compression, and GPU optimizations for NTT and GEMM that deliver orders-of-magnitude higher throughput than prior systems.
-
Need to Know: Contextual-Integrity-Grounded Query Rewriting for Privacy-Conscious LLM Delegation
Introduces DelegateCI-Bench (3167 samples) and a CI-guided RL query rewriter that improves privacy-utility tradeoff by up to +10.1 utility over on-device baselines.
-
Fair Finetuning Mitigates Distribution Inference Attacks
Fair fine-tuning under Equalized Odds yields a tight bound Adv(A, M_f) ≤ Δ_EO · W on adversarial advantage in distribution inference attacks, with empirical reductions below detection threshold across six datasets.
-
Neuroforger: certified violation witnesses for smart contracts verification via LLMs
Neuroforger generates certified violation witnesses for smart contracts by representing specs as Solidity tests with abstract-type variables, using LLMs to instantiate them, and validating via type checking plus execution.
-
Conceptual Steganography
Conceptual steganography encodes covert information in high-level reasoning patterns within LM chains-of-thought, remaining robust to paraphrase defenses while preserving reasoning utility.
-
Longitudinal Analyses of SAST Tools: A CodeQL Case Study
CodeQL detected 171 CVEs total, with 83 caught by a prior version before the fix; detections were often actionable within the vulnerable file but not stable across tool versions.
-
Zombies in Alternate Realities: The Afterlife of Domain Names in DNS Integrations
Zombie domain linkages persist after ownership changes in DNS integrations at rates of 3% in Web PKI, 24% in ENS, and 15% in Maven Central, with validate-once designs accumulating long-term risks while per-use validation prevents them.
-
Differentially Private Runtime Monitoring
A technique for enforcing differential privacy in temporal runtime monitoring by analyzing dependencies and injecting noise into specifications while using tree mechanisms to limit accuracy loss.
-
Your Loss is My Gain: Low Stake Attacks on Liquid Staking Pools
A low-stake adversary can degrade a liquid staking pool's performance via consensus manipulation and profit from the resulting drop in its LST value through application-layer financial positions.
-
Analysis of Commit Signing on Github
Most 'verified' commits on GitHub are automatically signed by the platform's web interface; genuine developer-managed commit signing is rare, inconsistent, and marked by unrevoked expired keys.
-
COD-ssi: Enforcing Mutual Privacy for Credential Oblivious Disclosure in Self Sovereign Identity
COD-ssi enables mutual privacy in SSI credential exchanges by using OPRFs for claim-oblivious disclosure, with formal security verification and a prototype showing moderate overhead.
-
A Deductive System for Contract Satisfaction Proofs
A sound and complete deductive system for relative trace equality based on relative bisimulation is introduced, formalized in Rocq, and demonstrated on two contract satisfaction proofs.
-
Measuring and Exploiting Contextual Bias in LLM-Assisted Security Code Review
LLM-based security code review is vulnerable to framing bias, with a novel iterative refinement attack achieving 100% success in reintroducing vulnerabilities across real projects.
-
Grassroots Bonds as a Foundation for Market Liquidity
Grassroots bonds add maturity dates to local cryptocurrencies to enable lending and other instruments via enforceable digital social contracts.
-
When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
APIDiffer automatically detects 72 API inconsistencies across 11 Ethereum clients using specification-guided test generation and LLM-based false-positive filtering, with 90% of bugs confirmed by developers.
-
A Composable Game-Theoretic Framework for Blockchains
Introduces the first compositional game-theoretic framework for blockchains using cross-layer games and cross-application composition to analyze incentive compatibility and reveal vulnerabilities in composed systems.
-
Uncovering Similar but Different Packages in PyPI and Potential Security Threats
Large-scale analysis of 200K PyPI packages identifies 1,361 replicated popular packages, 256 replicated vulnerable packages, and 7 new replicated malicious packages, showing replication as a security threat vector.
-
Beyond Classification Accuracy: An Exploration-Range Evaluation of Adaptive Crawling for Fake Shopping Sites
An adaptive crawler using classifier feedback and seed-compound query generation discovers approximately 7.6 times more cumulative unique fake shopping hosts than a fixed-keyword baseline by cycle 3.
-
ATTAIN: Automated Exploit Failure Analysis through Trace-Driven Diff Analysis
ATTAIN is a three-module trace-driven framework that combines exploit execution, LLM-guided diff search, and evidence-based judgment to identify affected library versions for CVEs, reporting 93.24% F1 on 224 CVEs across 25,943 versions.
-
AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling
AttackPathGNN introduces a State Interference Graph and conjunction pooling inside a GNN to detect cross-function vulnerabilities in Solidity contracts, reporting 92.3% F1 on SmartBugs Wild.
-
GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation
The paper fixes two bugs in Go's extendedGCD for RSA key generation, proves the corrected version correct and terminating via Gobra with Lean lemmata, and reports a 24% speedup.
-
A formal framework for the economic security of DeFi compositions
Introduces MEV non-interference and local MEV as formal notions to enable modular reasoning about economic security in DeFi contract compositions.
-
Pretraining Data Exposure in Large Language Models: A Survey of Membership Inference, Data Contamination, and Security Implications
First unified survey formalizing Pretraining Data Exposure across exposure levels and reviewing attack, defense, and contamination methods for LLMs.
-
GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification
GRASP detects anomalies in system provenance graphs via self-supervised executable prediction from two-hop neighborhoods, outperforming prior PIDS on DARPA datasets by identifying all documented attacks where behaviors are learnable plus additional unlabeled suspicious activity.
-
EASE: Federated Multimodal Unlearning via Entanglement-Aware Anchor Closure
EASE closes three residual anchors in federated multimodal unlearning using bilateral displacement, cosine-sine decomposition, and forget lock, achieving near-retrain performance on forget and retain data.
-
Privacy, Prediction, and Allocation
Private variants of individual and unit-level aid allocation admit interpretable bounds trading privacy, efficiency, and targeting precision in stochastic and distribution-free settings.
-
Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection
ESPRESSO achieves over 0.99 true positive rate at 10^{-3} false positive rate for stepping-stone intrusion detection on synthetic data for SSH, SOCAT, ICMP, DNS and mixed protocols, outperforming DeepCoFFEA while also enabling chain length prediction.
-
Variational Feature Compression for Model-Specific Representations
A variational latent bottleneck with KL regularization and a dynamic binary mask based on saliency produces model-specific features that keep high accuracy for one classifier but drop others below 2% on CIFAR-100 with over 45x suppression.
-
PrivacyAkinator: Articulating Key Privacy Design Decisions by Answering LLM-Generated Multiple-choice Questions
PrivacyAkinator uses LLM-generated questions grounded in data-flow representations and a news-mined design space to help developers surface privacy decisions, yielding 47% more decisions identified in 73% less time than PRAM in a 24-person study.
-
Content Fuzzing for Escaping Information Cocoons on Digital Social Media
ContentFuzz rewrites posts with LLM guidance from stance model confidence to flip machine labels without altering human intent, tested across four models and three datasets in two languages.
-
GPIR: Enabling Practical Private Information Retrieval with GPUs
GPIR achieves up to 297 times higher throughput than prior GPU PIR systems by fusing operations in stages and using pipelined transposed layouts to cut DRAM traffic during batched lattice-based queries.
-
Beyond Crash-to-Patch: Patch Evolution for Linux Kernel Repair
Reconstructing 6946 syzbot bug-fix lifecycles reveals that accepted kernel patches are non-local and reviewer-constrained, enabling PatchAdvisor to improve automated repair quality over baselines via retrieval and diagnostic guidance.
-
Automated Side-Channel Analysis of Cryptographic Protocol Implementations
A binary-analysis pipeline finds a first-contact privacy leak in WhatsApp Desktop by checking protocol models against instruction-cache side-channel observations.
-
Toxic Memes: A Survey of Computational Perspectives on the Detection and Explanation of Meme Toxicities
A PRISMA-based survey of 158 computational works on toxic meme detection introduces a new toxicity taxonomy and a framework linking target, intent, and conveyance tactics while noting trends in LLMs and cross-modal methods.
-
Can AI-Generated Text be Reliably Detected?
Recursive paraphrasing attacks substantially lower detection rates for multiple AI text detectors with only minor quality loss, while a theoretical analysis ties best-case AUROC to total variation distance between human and AI distributions.
-
Typing Behavior in Human-LLM Interaction: Keystroke Dynamics Reveal Cognitive Effort During Prompting
User study finds that task difficulty affects keystroke dynamics during LLM prompting as a marker of cognitive effort, while device type has weaker effects and keystrokes do not predict perceived output usefulness.
-
A Typestate Approach to Purpose-aware Programming
PurPL is an OO language whose typestate system models data purpose sets that grow or shrink to enforce usage compliance.
-
Bringing Managed Language Support to WebAssembly with External Library Linking
WALL-E uses external library linking via client-server architecture to support ten managed languages in WebAssembly with hundreds-fold speedup over nested runtimes.
-
Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems
Proposes cryptographic registry identity, dual-signature model, and authoritative namespace binding to create three defense layers against dependency confusion.
-
KingsGuard: Enclave Data Protection Under Real-World TEE Vulnerabilities
KingsGuard adds hardware data-flow tracking and checks to TEE enclaves to prevent sensitive data leakage from vulnerabilities while supporting intentional declassification.
-
A Multi-Agent Framework for Automated Exploit Generation with Constraint-Guided Comprehension and Reflection
Vulnsage, a multi-agent framework, generates 34.64% more exploits than prior tools and verified 146 zero-day vulnerabilities in real-world open-source libraries.
-
LLM-Assisted Web Measurements
LLMs achieve strong performance on website classification tasks relevant to web measurements and support a practical two-step methodology for targeted studies from the Tranco list.
-
Evasion Under Blockchain Sanctions
Empirical analysis of 1.07 billion Ethereum transactions shows sanctions cut Tornado Cash deposits by 71% yet the mixer remained central to most security incidents, exposing three structural enforcement weaknesses.
-
OpDiffer: LLM-Assisted Opcode-Level Differential Testing of Ethereum Virtual Machine
OpDiffer applies LLMs and static analysis to opcode-level differential testing of EVMs, reporting 26 previously unknown bugs across nine implementations along with coverage gains and an estimate that 7.21% of real contracts could trigger the bugs.
-
Quantifying the Impact of Stealthy BLE Spam & Flooding Attacks on IoT Environments
Develops a quantitative foundation for BLE flooding attack impacts on IoT and proposes an agility-based deterrence strategy.
-
The Impact of Configuring Agentic AI Coding Tools on Build-vs-Buy Decisions: A Study Protocol
The paper outlines a controlled study protocol using staged programming tasks to measure the effects of configuration mechanisms on build-versus-buy decisions in Claude Code and OpenAI Codex.