Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
The General Data Protection Regulation (GDPR, a European law that controls how organizations collect and use personal data) was created to control large tech companies but also applies to smaller organizations like schools. A research study in Italian schools found tension between following strict top-down rules and making practical decisions based on actual risks to protect data.
Evasion attacks (methods where attackers trick AI systems into ignoring safety rules by manipulating input data) have been researched for more than ten years, but most real-world examples remain theoretical and academic. Because these demonstrations seem more like intellectual exercises than practical threats, people have largely dismissed evasion attacks as unimportant in actual security situations.
Researchers created a hybrid system that combines SAST (static application security testing, which automatically scans code for vulnerabilities) with LLMs (large language models) to better filter and prioritize security alerts. The system reduced false positives (incorrect security warnings) by 91% in real deployments by using AI to intelligently triage findings and generate automated exploit examples.
This research introduces CREF (Cryptographic Resource Enabled Framework), a system that controls access to stored data based on policies without requiring users to hold private keys (secret numbers used in encryption). Instead of traditional keys, the system uses temporary credential tokens issued by multiple authorities, and it uses lattice-based cryptography (a math method believed to be secure even against quantum computers) to ensure that both credentials and access policies cannot be forged.
This research identifies a security weakness in wireless challenge-response Physical Layer Authentication (PLA, a method that uses wireless channel characteristics to verify identity), which assumes random fading channels (unpredictable signal variations) but fails when real-world channels show patterns instead. The authors propose an attack method called Maximum Differential Likelihood Generator (MDLG) that exploits these patterns and develop a testing guideline using randomness checks to determine when PLA is actually safe to use in practical wireless systems.
Fix: The source proposes using randomness testing as a measurable guideline to decide when PLA can be safely used in practical wireless channel conditions. The authors validate this approach through real-world experiments to demonstrate how the proposed guideline can help protect the security of PLA systems.
IEEE Xplore (Security & AI Journals)Large text-to-image diffusion models (AI systems that generate images from written descriptions) can accidentally create inappropriate content like copyrighted artwork or offensive images, and existing removal methods often fail because unwanted concepts can reappear in subtle ways. The paper proposes SAFER, a method that identifies a concept-specific subspace (a mathematical region in the model's embedding space, which is how the AI represents meaning) associated with unwanted content and then projects prompts away from that region to remove the concept from generated images.
Fix: The paper describes SAFER as the proposed approach: it 'identifies a concept-specific subspace associated with the target concept' and then 'projects the prompt embeddings onto the complementary subspace,' which 'effectively erases the concept from the generated images.' The method also uses 'textual inversion to learn an optimized embedding of the target concept from a reference image' for more precise removal, and introduces 'a subspace expansion strategy to ensure comprehensive and robust concept erasure.'
IEEE Xplore (Security & AI Journals)This research proposes a new blockchain-based voting protocol that supports quadratic voting (a system where voting power equals the square root of a voter's stake) combined with liquid democracy (where voters can delegate their votes to representatives). The protocol ensures voter privacy and verifiable results, and testing shows it works efficiently even with hundreds of voters, delegates, and projects.
Researchers developed R2BD, a new method to detect fake images created by AI (such as those made by diffusion models, VAEs, or GANs, which are different types of generative AI systems) by reconstructing them and measuring the differences from originals. The method is much faster (over 22 times speedier) than previous approaches because it works in a single step instead of many steps, and it works better across different types of AI image generators and different datasets.
This research presents a new method for detecting deepfakes (AI-generated fake videos or images of people) that works better when the forgery techniques differ between training and testing. The approach uses orthogonal moment watermarking (embedding hidden marks in images using mathematical transforms), which stays intact when images are distorted but gets disrupted by deepfake manipulations, allowing the system to achieve 92.58% accuracy in detection.
Clara is a new framework for detecting software vulnerabilities (weaknesses in code that attackers can exploit) by combining information from multiple sources: code written as text sequences and code represented as graphs (visual structures showing how different parts connect). The framework uses two techniques to better blend this information together: a local fusion module that uses learnable prompts (instructions that guide the AI to focus on relevant details) to help different data types interact, and a global fusion module that uses attention mechanisms (ways of deciding what information matters most) to adaptively weigh contributions from each data source.
Researchers discovered that deep neural networks (DNNs, a type of AI used for face and voice recognition) are vulnerable to embedding reconstruction attacks (ERAs, where attackers recover the original biometric data from the compressed numerical representation that the system stores). This attack works even when attackers have very limited access to the system, such as only seeing yes/no decisions or final scores, which is common in real-world commercial APIs.
Researchers created a new searchable encryption (SE, a method that lets you search encrypted data without decrypting it first) scheme that protects against leakage-abuse attacks (attacks that exploit information accidentally revealed during searches) in multi-keyword retrieval scenarios. The system uses volume bucketization (grouping search results by how many documents match) and dynamic bitmap techniques to hide search patterns while achieving 100 times better efficiency than existing methods on large datasets.
Fix: The authors propose their secure system-wide SE scheme using: (1) volume bucketization technique to protect the volume of retrieved documents, (2) dynamic bitmap and adaptive volume hiding techniques for multi-keyword retrieval, and (3) optimizations that significantly reduce computational and communication complexity and minimize update rounds. According to experiments, this approach reduces client-side cache overhead by 78% and achieves at least 100× improvement in write-back and update efficiency compared to existing solutions.
IEEE Xplore (Security & AI Journals)This paper presents SCZ-HA, a security scheme that allows vehicles to smoothly switch between different communication zones when moving along roads (called cross-zone handovers in V2I communication, which connects vehicles to roadside infrastructure like 5G base stations). The scheme uses two types of credentials (long-term and short-term) and a technique called Shamir's secret sharing (a method to split information into pieces so no single piece reveals the secret) to reduce delays and security risks during these handovers, achieving 70.54% faster authentication than existing methods.
Machine learning systems used to detect Android malware (malicious software on Android phones) are vulnerable to evasion attacks, where attackers modify malware to trick the detection system into missing it. Researchers developed MalPurifier, a defensive framework that uses adversarial purification (a technique that removes deceptive modifications from suspicious code) combined with a Denoising AutoEncoder (a type of neural network that learns to clean up noisy or corrupted data) to protect detection systems and maintain accuracy above 90% against various evasion attacks.
Fix: MalPurifier is described as "a lightweight, model-agnostic, and plug-and-play module" that integrates "a diversified adversarial perturbation mechanism for robustness and generalizability, a protective noise injection strategy for benign data integrity, and a Denoising AutoEncoder with a dual-objective loss for accurate purification and classification." The framework is presented as "a practical and effective solution to bolster the security of ML-based Android malware detectors."
IEEE Xplore (Security & AI Journals)This paper proposes a new image sharing method that uses compressive sensing (a technique that compresses and encrypts data simultaneously) with multiple privacy levels, so different users can access only the information they need without seeing sensitive details. The method uses an algorithm called T-ℓ1-B2DLDA to compress images in a way that allows some users to classify or analyze images without reconstructing the original, while others with higher access levels can fully reconstruct them.
This research develops a privacy-preserving method for face recognition systems using the Privacy Funnel model, which balances the usefulness of facial data against protecting sensitive information like identity or demographic attributes. The authors introduce new versions of this model, including the Generative Privacy Funnel (GenPF) and deep variational Privacy Funnel (DVPF), and demonstrate that their approach works with modern face recognition systems while reducing information leakage about sensitive attributes.
Researchers have developed a dual-branch image tampering detection model that uses two parallel processing paths to identify when images have been altered or forged. The model analyzes both noise patterns (statistical irregularities in pixel data) and anomalous features (unexpected or out-of-place patterns) to detect tampering, offering a more comprehensive approach than methods that examine only one type of indicator.
This research paper examines how machine learning-based network intrusion detection systems (NIDS, software that identifies unauthorized access attempts) can use adaptive active-defense hardening to protect themselves against reinforcement learning (RL, a type of AI that learns by trial-and-error) driven attacks. The study compares this dynamic defense approach with traditional static defenses (fixed security measures that don't change).
This academic paper discusses extending SBOMs (Software Bill of Materials, a detailed list of all software components in a program) to create AIBOMs for agentic AI systems (AI systems that can take independent actions). The research focuses on adding new schema extensions (structured data formats) to track AI agent components, improving how these systems can be orchestrated (coordinated and controlled), and developing methods to evaluate whether AI systems produce consistent, reproducible results.
This research paper proposes a security method for IoV (Internet of Vehicles, where cars connect to networks) that combines blockchain (a distributed ledger technology that creates permanent, tamper-resistant records) with PUF (physical unclonable functions, unique fingerprints derived from hardware that are hard to fake) to create a two-factor authentication and key agreement scheme. The approach aims to improve security for vehicle communication and data exchange in connected car systems.