Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,003 items
EvoACC-BD-MIDS is a backdoor defense for Transformer-based multi-class intrusion detection systems in smart grids. It uses a genetic algorithm to automatically design an activation clustering combination strategy that minimizes backdoor attack success rate under a detection-performance constraint. On the Power System Attack Datasets with 37 classes, it keeps 91.4% average accuracy and reduces BASR from 98.89% to 0.00%.
Fix: The proposed EvoACC-BD-MIDS method itself is the defense; the source does not describe a separate patch, fixed version, configuration change or workaround. Code is linked at https://github.com/SomeonesGitee/EvoACC-BD-MIDS.git.
IEEE Xplore (Security & AI Journals)MUSTGL Fusion is an unsupervised spatio-temporal graph learning framework for detecting False Data Injection Attacks (FDIAs) in smart grids. It combines four learners, including an Echo State Network for temporal correlations, and flags attacks with an Isolation Forest trained on normalized residuals. On IEEE bus systems it reports F1 scores of 0.770, 0.979, and 0.895 for the 14-, 57-, and 118-bus systems.
This paper analyzes existing server-aided message-locked encryption (MLE) schemes and shows they are open to subverted implementations that can stealthily leak users' data, MLE keys and passwords. It also notes these schemes lack file sharing among users. The authors propose STEAD, a subversion-resistant portable MLE scheme with file sharing, which uses cryptographic reverse firewalls (CRFs) to rerandomize ciphertexts and filter messages. The authors formally prove its security and report comprehensive performance evaluations.
Researchers evaluated nine frontier multimodal language models directly commanding physical robotic arms on six manipulation tasks from the RoboDojo benchmark, across multiple reasoning-effort and service-tier settings. The models can control real arms for a range of tasks but are not yet precise or efficient enough to finish them within a practical action budget. Performance rose between July and October 2026, with a doubling time of 53.9 days, a 4.4x increase in the best execution rate, and a 6.2x drop in the lowest execution cost.
Researchers evaluated seven frontier multimodal language models, at multiple reasoning-effort settings, on six manipulation tasks from the RoboDojo benchmark, testing whether they can directly command physical robotic arms. Current models can perform a variety of manipulation tasks but are not yet precise or efficient enough to finish them within a practical action budget. Between July and September 2026, performance on the benchmark doubled every 44.5 days, the best execution rate rose 4.4 times, and the lowest execution cost fell 6.2 times.
CLIP-BCP is a dual-branch framework for detecting AI-generated images that combines the 13th-layer CLS token of a frozen CLIP encoder with a bright channel prior branch, fused at the feature level. On AIGCDetect-Benchmark and GenImage it reports mean accuracy of 94.28% and 98.29%, outperforming the previous best methods by 1.51 and 2.49 percentage points. The authors report that strict cross-dataset evaluation and postprocessing robustness tests support the complementarity of the two feature sources under the evaluated settings.
Researchers propose LADW (Label-Aware Distribution-based Dynamic Weighting), a black-box aggregation strategy for federated learning that defends against backdoor attacks without trusted client information. It uses a small auxiliary dataset, which may be synthetic data from a large text-to-image model, to infer each client's implicit label distribution from update similarity and reweight aggregation to suppress label-concentrated, potentially malicious updates. Experiments on multiple benchmarks report reduced attack success rates and preserved main-task accuracy, with state-of-the-art results under highly non-IID conditions.
Researchers present a prompt-only steganography method for closed LLM APIs that replaces hand-crafted linguistic toggles with a learned, disentangled semantic-stylistic latent space. A beta-VAE maps sentence embeddings to interpretable axes, and prompt directives guide each axis to a binary state, while a reverse arithmetic coding distribution matcher aligns the payload with first-order Markov transition statistics. Across four LLMs and five domains, the method reports about 91% CRC-verified recovery and up to 0.19 bits/token, with moderate, model-dependent detectability (zero-shot AUC 0.54-0.71; adaptive RoBERTa AUC 0.81).
Fix: STEAD deploys cryptographic reverse firewalls (CRFs) that rerandomize ciphertexts of MLE keys produced with users' hardened password-derived public keys, and modify users' incoming and outgoing messages during generation of MLE keys and hardened passwords to prevent secret leakage.
IEEE Xplore (Security & AI Journals)TAFL, a Trust-Aware Federated Learning framework, combines Subjective Logic and Multi-Agent Systems to detect anomalous clients, isolate them on probation, and reintegrate them after sustained recovery. The authors report 2–4% higher detection and 20–25% lower convergence latency on MNIST and CIFAR10 at 10–30% anomalous-client ratios, and 94.6–97.1% mean detection on CIFAR10 stress tests, with semantic-backdoor attack success reduced to 2.9%.
IFBA is a frequency-aware backdoor attack on multivariate time series forecasting models. It generates input-aware triggers from the local pre-trigger context and chooses poisoning variables and timestamps with a low-frequency spectral-consistency score. The authors report stronger attack effectiveness than prior forecasting backdoors on five public benchmarks and three architectures, with comparable clean accuracy.
Researchers ran 37 security skills with Claude Code and four underlying LLMs on 100 real Linux kernel vulnerabilities across ten classes, totaling 14800 runs. Only 24.4 percent of runs located the correct function, and 15.7 percent correctly classified the vulnerability. The authors propose SKILL-SIF, a self-improving framework that evolves skills from missed vulnerabilities, raising fully correct detection on unseen vulnerabilities from 2 percent to 16 percent.
MapSteal is a student-independent framework that recursively extracts question-answer pairs from black-box LLMs under a fixed QA budget, using structured acquisition states and root-aware scheduling. Experiments with Qwen3.5 students at 2B, 4B and 9B scales reach competitive downstream performance across six medical and cybersecurity benchmarks. On the 4B medical evaluation, Full MapSteal improves average accuracy by 1.17 percentage points over a simplified recursive variant, though gains vary by domain and evaluation panel.
SEAL is a two-stage method for persistent tool poisoning against LLM agents, where malicious instructions in tool descriptions or external resources manipulate tool selection. The authors show that existing tool poisoning attacks, which assume a single interaction round, degrade sharply in multi-round agentic settings because agents do not consistently surface attack-relevant reasoning as planning context evolves. SEAL combines Prefix-Eliciting Trigger Optimization (PETO) with Local-to-Universal Trigger Aggregation (L2U) to build a universal trigger, and experiments across seven multi-round scenarios and several models show its effectiveness, transferability and resistance to potential defenses.
PatchAlign is an end-to-end workflow for binary patch presence testing (PPT), which determines whether a security fix is present in a stripped binary. It first localizes patch-relevant code at large scale using instruction-aligned retrieval and caller-callee context, then uses an LLM to compare the target binary with vulnerable and patched references. The authors report that it localizes patch-relevant code and determines patch status without a target-location oracle.
A research paper shows that an AI agent can match the distribution of its messages and the receiver's task outcomes while leaking private information the task never required. Selecting among 16 responses from Qwen2.5-1.5B-Instruct on a synthetic routing task let a public decoder recover a private bit in all 8,192 held-out rounds at 98.60% routing accuracy. The authors argue that passive auditing cannot certify this kind of leakage, and that a canonical task interface bounds the remaining information about a balanced attribute by twice the routing-error rate.
Fix: A canonical task interface preserves every receiver decision and bounds the remaining information about a balanced attribute by twice the routing-error rate, even for a receiver that shares a key with the sender.
Arxiv (cs.CR + cs.CL + cs.LG)This Systematization of Knowledge presents PIAtlas, a taxonomy of prompt injection attacks organized by how the injected instruction is constructed to subvert the model, with six classes forming the roots of a hierarchy of techniques. The authors release PICorpus and map thousands of records from more than twenty public datasets to PIAtlas under a human-verified protocol. The mapping finds that attacks usually combine techniques from a few mechanisms and that widely used agent benchmarks test only part of the attack space.
Researchers propose MABA, a distributed backdoor attack for Federated Learning in which each malicious client builds a local trigger aligned to the benign model's feature distribution via Maximum Mean Discrepancy (MMD) constraints. The malicious clients then collaboratively form a persistent global trigger that adapts to update magnitudes and sample features with dynamic noise intensity. On federated image classification with convolutional neural networks, the method evades existing defenses and keeps attack success above 90% on CIFAR-10 under most defenses across 200 post-attack rounds, reaching 100% on CIFAR-10 and over 90% on FMNIST and CIFAR-100.
This research defines critical compilation strictness, the smallest set of enforceable source and reference-semantic sites whose protection excludes a prescribed decision violation across all legal joint compiler configurations on a declared input domain. On a five-site ConvNet under PyTorch 2.6.0+cpu with the Inductor backend, the triggered target-label proportion rises from 0.1078 under eager execution to 0.9996 under compilation, and protecting only the feature stem is the unique minimum decision-preserving policy. The authors report that selective strictness reduces warmed batch latency by roughly 29% relative to all-strict execution.
Fix: The source discusses selective strictness as a protection policy: protecting only the minimal set of sites, such as the feature stem in the ConvNet case, preserves the decision. It does not describe a specific patch, fixed version, or configuration change for end users.
OpenAlex (peer-reviewed AI security)CAT-RAG is an agentic retrieval-augmented code generation framework that uses an LLM categorizer agent to select compact, language-specific security categories in place of CWE-level retrieval. It works standalone or as a drop-in add-on to RACG pipelines without modifying the underlying model. On CyberSecEval it improves secure code generation by 23.57% versus 12.11% for the prior state of the art, while cutting token overhead by 41.71%.
The authors co-train attacker and defender populations of LoRA adapters over one frozen base model, using PRPO (Peer-Relative Policy Optimization), where rewards come from execution in isolated containers rather than static datasets. The resulting 7B diff reviewer reaches 64.8% balanced accuracy on four unseen applications in three untrained languages, 5.5 points above supervised security fine-tuning and 4.4 above a frozen Claude Opus 4.8 reviewer. The 9B repository agent recovers 23 of 172 held-out VulnGym advisories, against 10 after supervised fine-tuning.