Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
This is a survey paper that reviews different compression algorithms (techniques for making AI language models smaller and faster) used in language models. The paper examines various approaches to reducing model size without significantly losing performance. It was published in October 2026 as an academic overview of the field.
Universities are undergoing digital transformation (DT, the process of integrating digital technology into all aspects of an organization) to meet changing student expectations and keep pace with rapidly evolving knowledge. The study identifies five key themes of this transformation, including platformization (building technology platforms as core infrastructure) and partnership models, which are shifting how universities operate: from treating all students the same to personalizing learning, from focusing on what the university provides to focusing on what students need, and from viewing students as passive consumers to active participants who help create content.
AI is enabling workers to take on tasks traditionally done by other job roles, a pattern called task crossover (work historically associated with one occupation appearing in how people in another occupation use AI). Analysis of over 800,000 ChatGPT messages from U.S. users shows that 43.5% of occupation-specific messages involve tasks outside the user's own job, with some roles like customer service workers doing outside-occupation tasks 77% of the time, suggesting AI is reshaping which tasks different jobs include before job titles officially change.
This research paper analyzes adversarial attacks, which are methods where attackers deliberately craft malicious inputs to fool AI systems, specifically targeting spam filters (software that identifies unwanted emails). The study examines how these attacks work and their implications for email security systems that rely on machine learning (AI trained on examples to recognize patterns).
SemAder is a technique that can fool LLM-based binary code analysis tools (AI systems trained to understand compiled machine code) by manipulating both the code's structure and its underlying meaning. The research, published in ACM Transactions on Privacy and Security, demonstrates that attackers can evade detection by simultaneously changing how the code is organized and what it actually does, making it harder for AI-powered security analysis to identify malicious behavior.
This research paper describes a watermarking technique that allows AI model creators to verify they own their models, where the watermark stays hidden during normal use but becomes visible when the model is updated. This approach helps protect against model theft and unauthorized copying by giving developers a way to prove ownership if their model appears elsewhere.
Researchers discovered that large language models (AI systems trained on vast amounts of text data) can be used to generate attacks against industrial control systems (computers that manage critical infrastructure like power grids and factories). The study shows that LLMs can synthesize, or create, realistic attack strategies when prompted to do so, raising concerns about the security of systems that keep essential services running.
This academic paper from ACM Transactions on Privacy and Security presents a policy-based conjunctive scheme, a method for managing the deletion of data that is owned or controlled by multiple parties. The research addresses the challenge of 'digital forgetting' (the ability to completely remove data from systems), which becomes complicated when more than one person has rights or claims to that data. The paper proposes a framework using policies (rules that determine who can do what) to coordinate data deletion across co-owned datasets.
This academic paper examines privacy risks in vertical federated learning (a technique where multiple organizations train AI models together while keeping their own data separate), specifically focusing on agnostic inference attacks that can expose sensitive information. The researchers analyze how attackers might infer private data even when the system doesn't require them to know the data's exact structure or type beforehand.
This research proposes a new system called TRFE-UIP (traceable registered functional encryption for unbounded inner product) that helps web platforms securely compute operations on encrypted high-dimensional data while identifying who leaked information if it escapes. The system uses functional encryption (a method that allows specific calculations on encrypted data without revealing the original information) and eliminates the need for fixed data size limits, making it more practical for real-world applications with many users and large datasets.
PREFed is a backdoor attack (a method to secretly inject malicious behavior into AI models) designed for federated learning (a distributed machine learning approach where multiple parties train a model together without sharing raw data). Unlike previous attacks that continuously adapt their malicious updates during training, PREFed pre-optimizes its trigger patterns (the inputs that activate the backdoor) before training starts, making the attack harder to detect while reducing computational overhead.
Java libraries sometimes work differently than their developers intended, creating a security problem called 'expectation inconsistency' where programmers misuse the libraries and accidentally introduce vulnerabilities. Researchers created a tool called EIFinder that scanned nearly 30,000 popular Java libraries and found nearly 8,000 APIs (pre-built functions) with this problem, including 972 zero-day RCE (remote code execution, where attackers can run commands on a system) vulnerabilities affecting libraries from major companies like Google, Apache, and IBM.
UnVC is a defense system designed to prevent voice cloning (creating fake copies of someone's voice) by modifying a person's original speech in a way that protects it. The system uses a technique called WaveGlow (a generative model that creates speech patterns) combined with adversarial approaches (methods that add protective distortions) to create modified speech samples that sound natural but block voice cloning attempts, even when audio is shared on social media or re-recorded.
SHRD is a new method for securely sharing files in cloud storage systems that need to handle complex hierarchical structures (like in hospitals or government agencies where different people have different access levels). The approach improves on existing methods by reducing computational overhead (the processing work required) through a symmetric key hierarchy that allows one encryption operation to handle multiple files, and by using a rank-aware dissemination tree (a structure that accounts for user access levels) that eliminates redundant re-encryption (the process of converting encrypted data so different users can access it).
Visual Large Models (VLMs, AI systems that understand images and are used in self-driving cars) need protection from intellectual property theft, but traditional methods like watermarking hurt their performance. This paper proposes a new protection framework using zero-knowledge proof (a technique that proves something is true without revealing the actual information), which includes a fingerprinting method that improves the ability to detect stolen models without harming the AI's ability to perceive traffic scenes, and a verification protocol called zk-DeepIP that protects both the model and test data from leakage during verification.
Fix: The paper proposes two components: a model fingerprinting method that assigns higher weights to high-discriminability samples near decision boundaries using cross-entropy loss to generate enhanced fingerprints, and the zk-DeepIP protocol, which is an IP verification protocol underpinned by zero-knowledge proof technology that ensures robust security while remaining compatible with existing IP verification methods.
IEEE Xplore (Security & AI Journals)SilentLedger is a blockchain system that protects transaction privacy while still allowing authorized auditors to identify participants and transaction amounts when needed, without requiring real-time communication between users and auditors. The system uses a renewable anonymous certificate scheme (a method for proving identity while staying anonymous) combined with encryption and digital signatures to let users create transactions independently, while auditors can recover audit data directly from the blockchain. The authors prove their system is secure and demonstrate it works efficiently in practice.
This academic paper introduces CEMT (Cyber Evaluation and Management Toolkit), a framework for assessing the cybersecurity reliability of complex systems, particularly those using AI capabilities. The toolkit helps evaluate whether AI-powered systems are secure enough to trust for critical tasks, addressing the challenge that traditional security testing may not fully capture risks in advanced AI systems.
Researchers developed NEO, a method for conducting adversarial attacks (adding subtle, imperceptible changes to videos to trick AI recognition systems) on deep learning video models more efficiently. NEO uses information entropy (a measure of uncertainty in data) to focus its attacks on the most informative points near decision boundaries (the threshold where a model switches from one prediction to another), achieving better attack success rates while requiring fewer queries to the target system.
User prompts sent to cloud-based LLMs can expose sensitive information, and small input changes can drastically alter LLM responses, making privacy protection difficult. PrivAnalogy is a framework that protects privacy by transforming sensitive data in prompts into analogous expressions on the user's device before sending them to the LLM, then converting responses back to reflect the user's original intent. Testing shows the framework resists prompt inversion attacks (where someone tries to extract the original sensitive data from the LLM's response) significantly better than comparable methods while keeping response quality high.
Fix: PrivAnalogy uses two core components: an analogy selection module that applies local differential privacy (a mathematical privacy protection technique) to convert sensitive content into analogous expressions, and an analogy reversion module that restores semantic alignment between the LLM's response and the original prompt to ensure accurate answers.
IEEE Xplore (Security & AI Journals)This paper presents Iasta, a new stream cipher (an encryption method that processes data one piece at a time) designed to work efficiently with hybrid homomorphic encryption (HHE, a technique that lets servers perform calculations on encrypted data without decrypting it first) in IoT (Internet of Things) systems. The problem it solves is that existing HHE systems are too slow and use too much computer power on devices and servers. Iasta improves performance by using special mathematical techniques and a redesigned encryption structure, achieving 2-5 times faster speeds compared to the previous best option (Pasta).