Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

For TEE security advice, LLM failures transfer across assistants—up to 12%—and a four-control pipeline cuts them by 80%.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 21:36 UTC pith:UELPFUHO

load-bearing objection A useful TEE-focused LLM red-teaming benchmark whose headline numbers (12% transferability, 80.6% reduction) rest on labels with no reliability evidence and a pipeline that is only sketched. the 4 major comments →

arxiv 2602.19450 v3 pith:UELPFUHO submitted 2026-02-23 cs.CR cs.AI

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Kunal Mukherjee , Spandan Mukherjee This is my paper
classification cs.CR cs.AI
keywords LLM security advisorsTrusted Execution Environmentsred teamingtransferabilityprompt injectionjailbreakSGXTrustZone
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that large language models used as Trusted Execution Environment (TEE) security advisors fail in ways that are partly systemic rather than purely idiosyncratic: a prompt that triggers a given failure in one assistant triggers the same failure in the other assistant up to 12.02% of the time. It also argues that treating the assistant as a component in a security pipeline—policy gating, retrieval grounding, structured templates, and verification checks—reduces worst-case failure prevalence by 80.62%. If true, the implication is that organizations should not rely on a single assistant or on provider diversification alone for TEE advice; shared prompt templates and copied workflows can propagate the same boundary, attestation, and mitigation mistakes across providers, and guardrails should be layered and verified.

Core claim

The central claim, on the paper's own terms, is that prompt-induced failures in TEE-related advice are measurable, partly transferable across LLM assistants, and containable by architectural controls. Concretely: using a 208-prompt benchmark with five paraphrases and five samples per prompt, binary failure labels defined by an explicit rubric, the authors measure that failures transfer between ChatGPT and Claude Opus up to 12.02% (tool-output misinterpretation, Claude-to-ChatGPT direction), and that the full defense pipeline reduces failure prevalence from 0.17/0.14 baselines to 0.02/0.04. The authors also report that transferability is asymmetric and that partial defenses can shift risk rat

What carries the argument

TEE-RedBench, a benchmark methodology built on three parts: a TEE-grounded prompt suite (six families, 208 prompts) targeting architecture, attestation, threat modeling, mitigations, attack awareness, and misuse probes; a dual-track rubric scoring accuracy, completeness, groundedness, uncertainty calibration, policy compliance, safe helpfulness, and misuse resistance; and a formal transferability metric defined as the conditional probability that a prompt-level failure in one assistant also occurs in the other. The defense pipeline—policy gate, retrieval grounding, structured template, verifier, human approval—is both the conceptual mapping from red-teaming to controls and the ablation targe

Load-bearing premise

The headline numbers rest on the reliability of the binary failure labels assigned by expert annotators, but the paper only says agreement was tracked (Appendix A) and reports no inter-annotator agreement statistic; if the labels are noisy or subjective, both the 12.02% transferability and the 80.62% reduction could be artifacts of annotation rather than properties of the assistants.

What would settle it

Recruit a fresh set of expert annotators, re-label a random sample of the 5,200 responses using the same rubric and decision rules, and compute inter-annotator agreement (e.g., Cohen's kappa) on the binary failure labels. Low agreement, or large disagreement on the specific prompts that drive the transferability and reduction numbers, would cast doubt on the central empirical claims.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Prompt templates that fail on one assistant are a plausible source of cross-provider failure; reusing a prompt or playbook can propagate the same error across assistants.
  • Provider diversification alone is insufficient: low-transfer errors are catchable by a second model, but high-transfer classes (mitigation hallucination, tool-output misinterpretation) need grounding and evidence checks.
  • Stacking all four controls is the only configuration that brings worst-case failure prevalence below roughly 5% in this study; partial ablations leave tail risk.
  • Verification can increase transferability (ChatGPT to Claude from 0.02 to 0.05), so adding tooling may shift failures into more consistent, cross-assistant patterns.
  • Human approval remains necessary; the paper notes guardrails do not create a proof of correctness.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A direct way to test the result: re-annotate a sample of the 5,200 responses with fresh expert annotators and report inter-annotator agreement on the binary failure labels; the headline numbers rest entirely on those labels, and the paper does not report such a statistic.
  • The transferability definition is conservative—it exists over paraphrases and samples—so the 12.02% may understate the probability that a single reused prompt template fails on both assistants in practice; per-prompt averaging rather than max aggregation would likely give a different number.
  • Because the paper identifies tool-output misinterpretation as the most transferable failure, an extension would be to measure whether adversarially poisoned tool outputs (rather than benign references) raise transferability further.
  • The defense ablation suggests a testable mechanism: verification checks standardize how models commit to claims, so they can convert idiosyncratic errors into shared ones; auditing verifier-driven changes to outputs could confirm or refute that mechanism.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper proposes TEE-RedBench, a red-teaming methodology for evaluating LLM assistants (ChatGPT-5.2 and Claude Opus-4.6) as TEE security advisors. It introduces a 208-prompt taxonomy across SGX/TrustZone topics, a dual-track rubric, and a failure taxonomy, and formalizes failure prevalence, transferability, and defense reduction (Eqs. 3–5). The paper reports that some prompt-induced failures transfer up to 12.02% across assistants and that an 'LLM-in-the-loop' pipeline combining policy gating, retrieval grounding, structured templates, and verification checks reduces failures by 80.62%. The evaluation uses 5 paraphrases and 5 samples per prompt, totaling 5,200 model calls, with blinded expert annotation and a small set of case studies. The manuscript also acknowledges that it is a methodology/benchmark design rather than a static leaderboard.

Significance. The topic is timely and important: LLM security advice in TEE settings can propagate unsafe architectures, and evidence of cross-assistant transferability would have direct operational implications. If the empirical claims are reliable, the paper makes a useful contribution by connecting red-teaming results to concrete architectural controls and by providing a reusable evaluation structure. The formalization of transferability, the conservative existence aggregation, the TEE-specific failure taxonomy, and the defense ablation design are genuine strengths. However, the two headline numbers rest entirely on author-assigned binary failure labels, and the paper does not report inter-annotator agreement, exact per-cell counts, or a derivation of the aggregate 80.62% reduction from the tables. These gaps currently prevent the quantitative conclusions from being fully supported.

major comments (4)
  1. [Appendix A; §5.1; Tables 3, 5, 6] All headline results (12.02% transferability, 80.62% reduction) are computed from binary failure labels described in §5.1 and Table 3. Appendix A states 'we track agreement on binary failure labels' but reports no agreement statistic (e.g., Cohen's kappa), no per-label counts, and no adjudication details. With only 208 prompts and low failure prevalence, a conditional transferability of 12% can correspond to a handful of positive-source prompts; annotation noise could dominate. Please report IRR statistics and per-prompt/per-failure counts, or temper the quantitative claims.
  2. [§6.2, Eq. (5); Table 6] The abstract/conclusion claim that the pipeline reduces failures by 80.62% cannot be derived from the reported data. Eq. (5) defines per-failure Δ_f, but Table 6 reports only aggregate prevalence per setting and no per-failure prevalence or aggregation weights. From Table 6's own numbers, the reduction is 88.2% for ChatGPT (0.17→0.02) and 71.4% for Claude (0.14→0.04); the paper does not state how 80.62% is formed from these or from any weighted combination. Please specify the exact aggregation and report uncertainty.
  3. [§5.2; Appendix A; Figure 1] The defense pipeline that yields the 80.62% reduction is described only conceptually. The retrieval corpus, policy-gate rules, structured template schema, and verifier checks are not specified, and the reproducibility link in Appendix A is a placeholder ('anonymous.4open.science/status/tee-redbench-xxxx'). The defense-reduction result is therefore not reproducible and may be sensitive to implementation choices that are not documented. The manuscript should either release the exact pipeline and ablation configuration or clearly mark the 80.62% number as a preliminary illustration.
  4. [§6.3, Table 5; Eqs. (3)–(4)] The transferability headline 'up to 12.02%' is not tied to a table entry with adequate statistical context. Table 5's maximum is 0.12±0.02 for tool-output misinterpretation (Claude→ChatGPT), but the reported ± is across prompts, not a confidence interval for the transfer probability. Because Eq. (3) collapses 25 outputs per prompt into one binary indicator, the conditional probability in Eq. (4) may be based on very few positive source prompts; 12% of 208 is ~25 prompts, but with per-failure prevalence often below 0.1 the effective denominator can be much smaller. Report exact counts, confidence intervals, and the specific cell behind the headline.
minor comments (4)
  1. [§B.5 vs Table 4] For misuse probes, §B.5 says only Policy compliance, Misuse resistance, and Safe helpfulness are scored, but Table 4 reports S (0–14) for the Misuse probes family as 12.14 and 11.56, implying all seven axes were scored. Clarify the scoring protocol or rescale the reported values.
  2. [Table 5] Column headers use up-arrows for transferability while the caption says lower is better; this notation is confusing and should be fixed.
  3. [Throughout] There are several typos and informal phrases: 'halul.' in Table 5; 'targetted' in §6.3; 'reduces failures' should be 'reduce failures' in the abstract; 'Which LLM Succeed' heading; and bullet-style 'Insights' paragraphs in §6.3 that are out of keeping with a formal evaluation section.
  4. [Appendix A] The paper does not state how many annotators scored how many prompts, how disagreements were distributed, or whether each prompt was double-scored. Reporting these details would strengthen confidence in the annotation process.

Circularity Check

0 steps flagged

No circularity: transferability and defense-reduction numbers are empirical measurements, not constructions.

full rationale

The paper's central quantitative claims are empirical measurements rather than deductions from inputs. Transferability (Eq. 4) is a conditional probability computed from binary failure labels assigned under the Section 5.1 rubric; the 12.02% figure is read from Table 5, not produced by an equation that presupposes it. Defense reduction (Eq. 5, Table 6) is obtained by re-running the protocol with the Figure 1 pipeline in an ablation sequence; the controls are described independently of the outcome, and residual failures remain even with all defenses enabled (Table 6: 0.02/0.04 prevalence), so the 80.62% reduction is not forced by definition. The rubric and failure taxonomy are author-defined benchmark instruments, which is normal for an evaluation benchmark and does not make the conclusions circular. Appendix A states 'we track agreement on binary failure labels' without reporting a kappa statistic; that is a measurement-reliability limitation, not a circular step, because no equation or result reduces to its own input. Self-citations ([7]-[10], [24]-[27]) appear in background and related-work motivation and are not load-bearing for the central transferability or defense-reduction claims. No specific reduction from a claim to a fitted parameter or to a self-citation chain can be exhibited.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

The paper's central quantitative claims rest on an author-defined rubric and annotation procedure without reported inter-annotator agreement, on a curated prompt set whose representativeness is asserted, and on a defense-pipeline implementation described only at a conceptual level. These are domain assumptions rather than mathematical axioms; they don't force the results by construction, but they do mean the headline numbers are only as credible as the hidden annotation and implementation details.

free parameters (2)
  • Rubric anchor thresholds (Table 1) = 0/1/2 anchors per axis
    Hand-defined scoring criteria for accuracy, completeness, groundedness, etc. No independent validation or reported inter-rater reliability, yet all failure labels and headline numbers depend on them.
  • Paraphrase count and sample count = |Φ(p)|=5, K=5
    Experimental protocol choices selected by the authors without sensitivity analysis. The 12.02% and 80.62% figures are specific to these settings and could shift with more paraphrases/samples.
axioms (4)
  • domain assumption Expert annotation is a valid ground truth for failure labels
    The transferability and defense-reduction results assume binary failure labels (Table 3) can be reliably assigned by human annotators. The paper states agreement is tracked but does not report a statistic, leaving this assumption unverified.
  • domain assumption The two LLMs (ChatGPT-5.2, Claude Opus-4.6) are representative of deployed assistants
    The study generalizes from two proprietary models with unstated release dates/snapshots. The paper acknowledges this in Limitations but still frames conclusions about 'LLMs' broadly.
  • domain assumption The prompt taxonomy and paraphrase set are representative of real practitioner workflows
    Prompts were 'curated from tech reports, blog posts, and interviewing security researchers' (Appendix A) with no inclusion/exclusion criteria, so representativeness is asserted, not demonstrated.
  • ad hoc to paper The defense pipeline components implement the described controls correctly
    Policy gate, retrieval grounding, structured templates, and verifier are described only conceptually; the actual implementation (retrieval sources, validator rules, templates) is not released, so the 80.62% reduction rests on an unverified implementation.

pith-pipeline@v1.3.0-alltime-deepseek · 17434 in / 12516 out tokens · 106742 ms · 2026-08-02T21:36:09.593382+00:00 · methodology

0 comments
read the original abstract

Trusted Execution Environments (TEEs) (e.g., Intel SGX and ArmTrustZone) aim to protect sensitive computation from a compromised operating system, yet real deployments remain vulnerable to microarchitectural leakage, side-channel attacks, and fault injection. In parallel, security teams increasingly rely on Large Language Model (LLM) assistants as security advisors for TEE architecture review, mitigation planning, and vulnerability triage. This creates a socio-technical risk surface: assistants may hallucinate TEE mechanisms, overclaim guarantees (e.g., what attestation does and does not establish), or behave unsafely under adversarial prompting. We present a red-teaming study of two prevalently deployed LLM assistants in the role of TEE security advisors: ChatGPT-5.2 and Claude Opus-4.6, focusing on the inherent limitations and transferability of prompt-induced failures across LLMs. We introduce TEE-RedBench, a TEE-grounded evaluation methodology comprising (i) a TEE-specific threat model for LLM-mediated security work, (ii) a structured prompt suite spanning SGX and TrustZone architecture, attestation and key management, threat modeling, and non-operational mitigation guidance, along with policy-bound misuse probes, and (iii) an annotation rubric that jointly measures technical correctness, groundedness, uncertainty calibration, refusal quality, and safe helpfulness. We find that some failures are not purely idiosyncratic, transferring up to 12.02% across LLM assistants, and we connect these outcomes to secure architecture by outlining an "LLM-in-the-loop" evaluation pipeline: policy gating, retrieval grounding, structured templates, and lightweight verification checks that, when combined, reduce failures by 80.62%.

Figures

Figures reproduced from arXiv: 2602.19450 by Kunal Mukherjee, Spandan Mukherjee.

Figure 1
Figure 1. Figure 1: LLM-in-the-loop secure architecture for TEE security advice. The assistant is treated as a [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. MoltGraph: A Longitudinal Temporal Graph Dataset of Moltbook for Coordinated-Agent Detection

    cs.SI 2026-02 unverdicted novelty 6.0

    MoltGraph is a new longitudinal graph dataset from Moltbook that characterizes heavy-tailed connectivity, short bursty coordination episodes, and substantially higher exposure for coordinated posts.

Reference graph

Works this paper leans on

32 extracted references · 5 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Demystifying Arm TrustZone: A comprehensive survey,

    S. Pinto and N. Santos, “Demystifying Arm TrustZone: A comprehensive survey, ”ACM Computing Surveys , vol. 51, no. 6, 2019. doi: 10.1145/3291047

    doi:10.1145/3291047 2019

  2. [2]

    Costan and S

    V. Costan and S. Devadas, Intel SGX explained, IACR Cryp- tology ePrint Archive, Report 2016/086, Available at https: //eprint.iacr.org/2016/086, 2016

    2016

  3. [3]

    Spectre attacks: Exploiting speculative execution,

    P. Kocher, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution, ” arXiv preprint arXiv:1801.01203, 2018. [Online]. Available: https: //arxiv.org/abs/1801.01203

    Pith/arXiv arXiv 2018

  4. [4]

    Meltdown: Reading kernel memory from user space,

    M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, A. Fogh, J. Horn, S. Mangard, P. Kocher, D. Genkin, and Y. Yarom, “Meltdown: Reading kernel memory from user space, ” inPro- ceedings of the 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 973–990. [Online]. Available: https:// www.usenix.org/conference/usenixsecurity18/presentation/ lipp

    2018

  5. [5]

    Foreshadow: Extracting the keys to the intel SGX kingdom with transient out-of-order execution,

    J. Van Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y. Yarom, and R. Strackx, “Foreshadow: Extracting the keys to the intel SGX kingdom with transient out-of-order execution, ” inProceed- ings of the 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 991–1008. [Online]. Available: https://www....

    2018

  6. [6]

    Plundervolt: Software-based fault injec- tion attacks against intel SGX,

    K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss, and F. Piessens, “Plundervolt: Software-based fault injec- tion attacks against intel SGX, ” in 2020 IEEE Symposium on Security and Privacy (SP) , 2020, pp. 1466–1482. doi: 10. 1109 / SP40000 . 2020 . 00057. [Online]. Available: https : / / www. computer. org / csdl / proceedings - article / sp ...

    2020

  7. [7]

    Interpreting gnn-based ids detections using provenance graph structural features,

    K. Mukherjee, J. Wiedemeier, T. Wang, M. Kim, F. Chen, M. Kantarcioglu, and K. Jee, “Interpreting gnn-based ids detections using provenance graph structural features, ” 2023

    2023

  8. [8]

    Mukherjee and M

    K. Mukherjee and M. Kantarcioglu, Llm-driven provenance forensics for threat intelligence and detection , arXiv preprint / manuscript, Under submission; preprint available, 2025

    2025

  9. [9]

    Evading provenance-based ml detectors with adversarial system actions,

    K. Mukherjee, J. Wiedemeier, T. Wang, J. Wei, F. Chen, M. Kim, M. Kantarcioglu, and K. Jee, “Evading provenance-based ml detectors with adversarial system actions, ” in USENIX Security Symposium (SEC), 2023

    2023

  10. [10]

    Proviot: Detecting stealthy attacks in iot through federated edge-cloud security,

    K. Mukherjee, J. Wiedemeier, Q. Wang, J. Kamimura, J. J. Rhee, J. Wei, Z. Li, X. Yu, L. -A. Tang, J. Gui, and K. Jee, “Proviot: Detecting stealthy attacks in iot through federated edge-cloud security, ” inApplied Cryptography and Network Security (ACNS), ser. LNCS 14585, Springer, 2024, pp. 241–

    2024

  11. [11]

    React: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Gabriel, and K. Narasimhan, “React: Synergizing reasoning and acting in language models, ”

  12. [12]

    Reflexion: Language agents with verbal reinforcement learn- ing,

    N. Shinn, B. Labash, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learn- ing, ” 2023. arXiv: 2303.11366[cs.AI]. [Online]. Available: https://arxiv.org/abs/2303.11366

    Pith/arXiv arXiv 2023

  13. [13]

    Mrkl systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning,

    E. Karpas et al., “Mrkl systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning, ” 2022. arXiv: 2205. 00445 [cs.CL]. [Online]. Available: https://arxiv.org/abs/ 2205.00445

    Pith/arXiv arXiv 2022

  14. [14]

    National Institute of Standards and Technology (NIST), Ar- tificial intelligence risk management framework: Generative artificial intelligence profile, NIST AI 600-1, Jul. 2024. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600- 1.pdf

    2024

  15. [15]

    OWASP, OW ASP Top 10 for Large Language Model Applica- tions (LLM), https://genai.owasp.org/llm-top-10/, 2025

    2025

  16. [16]

    Mindguard: Intrinsic decision inspection for securing llm agents against metadata poisoning,

    Z. Wang, H. Du, G. Shi, J. Zhang, H. Cheng, Y. Yao, K. Guo, and X.-Y. Li, “Mindguard: Intrinsic decision inspection for securing llm agents against metadata poisoning, ” 2025.doi: 10.48550/arXiv.2508.20412. arXiv: 2508.20412 [cs.CR]. [Online]. Available: https://arxiv.org/abs/2508.20412

    doi:10.48550/arxiv.2508.20412 2025

  17. [17]

    Assessing browser- level defense against IDN-based phishing,

    H. Hu, S. T. Jan, Y. Wang, and G. Wang, “Assessing browser- level defense against IDN-based phishing, ” in30th USENIX Security Symposium (USENIX Security 21) , USENIX Associ- ation, Aug. 2021, pp. 3739–3756, isbn: 978-1-939133-24-3. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity21/presentation/hu-hang

    2021

  18. [18]

    Beyond typosquatting: An in-depth look at package confusion,

    S. Neupane, G. Holmes, E. Wyss, D. Davidson, and L. D. Carli, “Beyond typosquatting: An in-depth look at package confusion, ” in32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA: USENIX Association, Aug. 2023, pp. 3439–3456, isbn: 978-1-939133-37-3. [Online]. Available: https : / / www. usenix . org / conference / usenixsecurity23 / present...

    2023

  19. [19]

    Google goes from laggard to leader as it pulls ahead of openai with stellar ai growth,

    D. Sophia and K. Cai, “Google goes from laggard to leader as it pulls ahead of openai with stellar ai growth, ”Reuters, Feb. 2026, Reports Gemini exceeding 750M monthly active users and ChatGPT exceeding 800M weekly active users (as stated by executives). [Online]. Available: https://www.reuters. com/business/google-goes-laggard-leader-it-pulls-ahead- ope...

    2026

  20. [20]

    Openai’s approach to external red teaming for AI models and systems,

    L. Ahmad, S. Agarwal, M. Lampe, and P. Mishkin, “Openai’s approach to external red teaming for AI models and systems, ” arXiv preprint arXiv:2503.16431 , 2025. [Online]. Available: https://arxiv.org/abs/2503.16431

    Pith/arXiv arXiv 2025

  21. [21]

    OWASP, OW ASP top 10 for large language model applications, Community standard, Nov. 2024. [Online]. Available: https: //owasp.org/www- project- top- 10- for- large- language- model-applications/assets/PDF/OWASP-Top-10-for-LLMs- v2025.pdf

    2024

  22. [22]

    Hypervision across worlds: Real-time kernel protection from the ARM TrustZone secure world,

    A. M. Azab, P. Ning, J. Shah, Q. Chen, R. Bhutkar, G. Ganesh, J. Ma, and W. Shen, “Hypervision across worlds: Real-time kernel protection from the ARM TrustZone secure world, ” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2014. doi: 10 . 1145 / 2660267.2660350. [Online]. Available: https://dl.acm.org/doi...

    arXiv 2014

  23. [23]

    Internationalized domain names for applica- tions (idna): Definitions and document framework,

    J. C. Klensin, “Internationalized domain names for applica- tions (idna): Definitions and document framework, ” IETF, RFC 5890, Aug. 2010. [Online]. Available: https://www.rfc- editor.org/rfc/rfc5890

    2010

  24. [24]

    Mukherjee, Z

    K. Mukherjee, Z. Alom, T. G. B. Ngo, C. G. Akcora, and M. Kantarcioglu, Optimal transport-guided adversarial attacks on graph neural network-based bot detection , arXiv preprint / manuscript, Under submission; preprint available, 2026

    2026

  25. [25]

    Provdp: Dif- ferential privacy for system provenance dataset,

    K. Mukherjee, J. Yu, P. De, and D. M. Divakaran, “Provdp: Dif- ferential privacy for system provenance dataset, ” inApplied Cryptography and Network Security (ACNS) , 2025

    2025

  26. [26]

    Z-rex: Human- interpretable gnn explanations for real estate recommenda- tions,

    K. Mukherjee, Z. Harrison, and S. Balaneshin, “Z-rex: Human- interpretable gnn explanations for real estate recommenda- tions, ” inKDD Workshop on Machine Learning on Graphs in the Era of Generative AI (MLoG-GenAI) , Oral presentation, Toronto, Canada, 2025

    2025

  27. [27]

    K. Mukherjee, Geoguard: Uwb timing-encoded key reconstruc- tion for location-dependent, geographically bounded decryp- tion, arXiv preprint / manuscript, Under submission; preprint available, 2025

    2025

  28. [28]

    Inferring fine-grained control flow inside SGX enclaves with branch shadowing,

    S. Lee, M.-W. Shih, P. Gera, T. Kim, H. Kim, and M. Peinado, “Inferring fine-grained control flow inside SGX enclaves with branch shadowing, ” in 26th USENIX Security Symposium (USENIX Security 17) , 2017, pp. 557–574. [Online]. Available: https : / / www. usenix . org / conference / usenixsecurity17 / technical-sessions/presentation/lee-sangho

    2017

  29. [29]

    [Online]

    OpenAI, GPT-4 system card, Technical report, 2023. [Online]. Available: https://cdn.openai.com/papers/gpt-4-system- card.pdf

    2023

  30. [30]

    running the key logic in TrustZone

    Anthropic, The claude 3 model family: Opus, sonnet, haiku (model card), Model card, 2024. [Online]. Available: https: //shorturl.at/L0Icq. A IMPLEMENTATION We implement the evaluation in four stages: (i) prompt normaliza- tion and paraphrase generation; (ii) repeated sampling under fixed inference settings; (iii) blinded security expert annotation; and (i...

    2024

  31. [268]

    doi: 10.1007/978-3-031-54776-8_10

    doi:10.1007/978-3-031-54776-8_10

  32. [2022]

    [Online]

    arXiv: 2210.03629 [cs.CL]. [Online]. Available: https: //arxiv.org/abs/2210.03629

    Pith/arXiv arXiv