AI Sec Watch

This research addresses a problem in adversarial training (a technique that teaches AI models to resist adversarial examples, which are inputs carefully designed to fool the model). When adversarial training tries to improve both normal accuracy and robustness at the same time, it struggles with hard samples (data points near the decision boundary where the model finds it difficult to classify correctly), often forcing a sacrifice of one goal for the other. The authors propose MHSI (mitigating hard sample interference), which uses two techniques: a weighted adaptive mechanism that helps the model focus more on learning clean samples, and a dynamic calibration strategy guided by gradient analysis that adjusts how the model handles hard samples, resulting in improved robustness without losing accuracy.

A WordPress plugin called 'Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI' has a security flaw (CWE-862, missing authorization) in versions up to 3.41.0 that allows contributors and higher-level users to add or remove taxonomy terms (tags and categories) on any post, even ones they don't own, due to missing permission checks. This vulnerability affects authenticated users who have contributor-level access or above.

Anthropic's MCP TypeScript SDK (a toolkit for building AI applications) versions up to 1.25.1 has a ReDoS vulnerability (regular expression denial of service, where a maliciously designed input causes the regex parser to work extremely hard and freeze the system) in its UriTemplate class. An attacker can send a specially crafted URI (web address) that makes the Node.js process (the JavaScript runtime environment) consume excessive CPU and stop responding, causing the application to crash or become unavailable.

This research paper describes a new machine learning method that combines Universum learning (using unlabeled data from the same domain as labeled training data to improve model training) with feature selection (choosing the most important input variables). The authors add an L0-norm penalty (a mathematical constraint that forces the model to use fewer features) to a support vector machine classifier, and develop an algorithm to solve this optimization problem efficiently.

DeepFilter is a modified AI framework based on Transformers (a type of neural network architecture) designed to monitor industrial processes more accurately and efficiently. Standard Transformers use self-attention (a mechanism where the model weighs the importance of different parts of input data), but this approach struggles with process monitoring because it doesn't capture meaningful patterns in logs and requires a lot of computation. DeepFilter replaces the self-attention layer with an efficient filtering layer that better identifies long-term patterns while using less computing power.

Neural architecture search (NAS, the automated process of designing AI model structures) can produce models that are vulnerable to adversarial attacks (manipulated inputs designed to fool AI systems). This paper presents ARNAS++, a method that searches for neural architectures that are both accurate and robust against adversarial attacks by using a flexible supernet (a large parent network from which smaller networks are derived) with adjustable parameter budgets and width.

Out-of-distribution (OoD, inputs that don't match what an AI was trained on) detection in object detection systems causes AI models to make overconfident wrong predictions on objects they shouldn't recognize. This paper reveals that popular benchmark datasets used to test OoD detection have quality problems, where up to 13% of test objects are mislabeled, making current methods appear better than they really are. The authors propose a new training-time approach where object detectors are fine-tuned using carefully created OoD training data that looks similar to normal objects, which reduces false detections by 91% in YOLO models.

A security vulnerability (CVE-2025-15453) exists in Milvus versions up to 2.6.7 in the expr.Exec function, where an attacker can manipulate the code argument to trigger deserialization (converting untrusted data back into executable code), allowing remote exploitation with user credentials. The vulnerability has been publicly disclosed and is rated as medium severity (CVSS 5.3).

Langflow, a tool for building AI-powered agents and workflows, has a security flaw in versions before 1.7.0.dev45 where some API endpoints (the interfaces that software uses to communicate and request data) are missing authentication controls (checks to verify who is using them). This allows anyone without a login to access private user conversations, transaction histories, and delete messages. The vulnerability affects endpoints that handle sensitive personal data and system operations.