Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Industrial IoT (IIoT, systems connecting factories and infrastructure to networks) systems need secure ways for multiple parties to create digital signatures together, but current methods are vulnerable to insider attacks that steal data. This research proposes MCRF, a scheme using Cryptographic Reverse Firewalls (CRFs, security layers that block unauthorized data leakage from compromised systems) with a two-stage architecture to protect against data theft in multi-party signing while keeping computational costs low.
Fix: The source proposes MCRF as a solution, which uses a commitment-based mechanism and a two-stage CRF architecture with input-side CRF for sanitizing messages and output-side CRF for re-randomizing signatures to protect against both input-triggered and output-stealth exfiltration attacks. However, this is a research proposal, and no implementation details, version numbers, or deployment instructions are provided in the source text.
IEEE Xplore (Security & AI Journals)LLM-based agents now use MCP tools (model context protocol tools, standardized connectors that let AI agents interact with external programs and services) to access external resources, but this creates a security vulnerability called tool poisoning attacks, where malicious MCP tools can trick these agents into behaving in harmful ways. Researchers developed AutoMalTool, an automated red teaming framework (a security testing approach where researchers simulate attacks to find weaknesses) that generates malicious MCP tools to expose these vulnerabilities in mainstream LLM-based agents.
This academic paper examines privacy risks in vertical federated learning (a machine learning approach where different organizations each hold different features of the same data and train a model together) when facing agnostic inference attacks (attacks where the attacker doesn't know the model's structure in advance). The paper analyzes how attackers could potentially infer private information from the shared computations in this system.
This research paper describes a new method for video steganography (hiding secret messages inside video files) that improves upon older techniques by better managing how distortion (unwanted changes to the video) spreads between frames. Instead of simply adding distortion like previous methods, this approach uses Synchronizing Mode Directions and a Distortion Propagation Chains model to track and control how distortion moves across frames, making the hidden messages harder for detection software to find while keeping the video quality high.
Model Inversion Attacks (MIAs, where attackers recover private training data by accessing a model's weights or outputs) pose serious privacy risks, and existing defenses don't protect well against attackers with different levels of knowledge. The paper proposes DAAS (Defense via Auto-Augmentation Search), which automatically finds the best combinations of data augmentation (transformations like cropping applied to images) that balance privacy protection and model usefulness better than current methods.
Fix: The source proposes DAAS (Defense via Auto-Augmentation Search), which automatically assesses and identifies augmentation candidates with strong privacy-utility trade-offs from a large augmentation pool. The final search results can then be leveraged for privacy-preserving training against MIAs.
IEEE Xplore (Security & AI Journals)N/A -- This content is a navigation menu and product listing from GitHub's website (v5.6.1), not a security issue, vulnerability report, or technical problem. It describes GitHub's features like Copilot (an AI coding assistant), Actions (workflow automation), and security tools, but contains no substantive technical content to analyze.
This research examines why mobile payment apps (MPAs, digital tools for financial transactions) are used differently across countries by analyzing over 34,000 user reviews. Using neural networks (computer systems inspired by how brains work) and natural language processing (NLP, techniques that help computers understand human language), the study found that cultural values significantly affect how features like security, ease of use, and low fees influence whether people adopt these apps. In traditional value-oriented cultures, security features matter less for adoption, while in survival-value-oriented cultures, both security and design quality become more important for encouraging use.
This study examines safety metrics for unmanned aircraft systems in urban airspace, specifically looking at how GPS (the satellite positioning system) and IMU (inertial measurement unit, a sensor that tracks motion and orientation) failures affect collision risk and surveillance performance under different conditions like varying speeds, traffic density, and weather. Researchers tested these failures to identify which safety metrics are most reliable for detecting risk and how well fail-safe systems (automatic safety mechanisms that activate when failures occur) protect against accidents.
Researchers discovered that signed graph neural networks (SGNNs, which are AI models that analyze networks with positive and negative relationships) are vulnerable to adversarial attacks (deliberate manipulations designed to fool the model) that exploit balance theory (a principle for modeling relationships in networks). To fix this vulnerability, the researchers propose BA-SGCL (Balance Augmented-Signed Graph Contrastive Learning), a new framework that uses contrastive learning (a technique where the model learns by comparing similar and dissimilar examples) combined with balance augmentation to make these models more resistant to attacks.
Fix: The source proposes Balance Augmented-Signed Graph Contrastive Learning (BA-SGCL), described as "an innovative framework that combines contrastive learning with balance augmentation techniques to achieve robust graph representations. By maintaining high balance degree in the latent space, BA-SGCL not only effectively circumvents the irreversibility challenge but also significantly enhances model resilience."
IEEE Xplore (Security & AI Journals)Quantum computers (powerful machines that could break current encryption methods) threaten blockchain security because traditional cryptographic algorithms like RSA are vulnerable to quantum attacks. Researchers proposed LLPP (Lightweight Lattice-based Privacy Protection), a blockchain framework using lattice-based cryptography (a quantum-resistant mathematical approach) combined with double encryption to protect transactions and user privacy even against quantum-capable attackers, while reducing storage overhead by storing only 46-byte identifiers on-chain through IPFS (a decentralized file storage system).
Fix: The LLPP framework addresses the storage challenge of lattice-based cryptography by leveraging the InterPlanetary File System (IPFS) for off-chain storage, recording only 46-byte content identifiers on-chain while maintaining full verifiability. The framework achieves practical deployment with signing and verification latencies below 2 milliseconds.
IEEE Xplore (Security & AI Journals)This research proposes a method to protect privacy in videos by selectively encrypting only the important parts (like detected people) rather than the entire frame, which saves computational resources. The approach uses object detection (YOLOv8, a tool for identifying people in images), encryption algorithms (mathematical methods to scramble data), and steganography (hiding encrypted information inside other data) to protect sensitive video regions while maintaining visual quality.
This paper addresses a problem in multi-view learning (training AI models using multiple types of data about the same object), where the training data contains incorrect labels that reduce model reliability in safety-critical applications. The authors propose TMNR and TMNR² methods that use evidential deep neural networks (models that estimate both predictions and confidence levels) to identify mislabeled data and learn effectively despite noisy supervision (imperfect training labels), achieving 7% accuracy improvements on heavily corrupted datasets.
Researchers discovered a new type of denial-of-service attack called ThinkTrap that targets cloud-based LLM services by crafting special inputs that force the model into extremely long or infinite generation loops, exhausting computing resources and making the service unavailable to legitimate users. The attack works even against closed-source models (where the inner workings are hidden) by using a technique that converts text tokens into continuous numbers and then optimizes adversarial prompts in a lower-dimensional space. Testing on commercial LLM services showed ThinkTrap could reduce system performance to as little as 1% of normal capacity or cause complete service failure.
This research presents UAP4MA, a method for generating universal adversarial perturbations (UAPs, which are small modifications that can fool AI models across many different inputs) that can deceive malware attribution models used to identify which criminal group created specific malware. The method uses a multi-agent Multi-Armed Bandit framework (a system where multiple decision-making agents work together to explore different options and find the best ones) to create these perturbations more effectively and efficiently than previous approaches.
Federated learning (a method where multiple computers train an AI model together without sharing their raw data) is vulnerable to poisoning attacks, where malicious participants sabotage the shared model. This paper proposes SpecShield, a defense that proactively tests each participant's model using carefully crafted perturbations (small, intentional changes) and analyzes their responses using frequency-domain analysis (a mathematical technique that examines patterns at different scales) to distinguish malicious clients from honest ones.
Fix: The paper proposes SpecShield, which works by: (1) using the Fast Gradient Sign Method on the server side to actively probe client models through calibrated adversarial perturbations, (2) analyzing the resulting responses in the frequency domain using Discrete Wavelet Transform to uncover distinctive patterns between benign and malicious clients, and (3) deriving theoretical upper bounds on perturbation magnitudes to guarantee detection accuracy while preserving benign client performance.
IEEE Xplore (Security & AI Journals)Large Vision Language Models (VLMs, which are AI systems that process both images and text) are vulnerable to jailbreak attacks (attempts to trick the AI into ignoring its safety guidelines). VLM-Guard is a detection framework that identifies and monitors a small set of neurons (individual computational units, about 0.2% of the total) that are linked to unsafe behavior, allowing it to catch jailbreak attempts without requiring model fine-tuning (adjusting the AI's internal parameters through additional training). The approach is lightweight and effective at detecting attacks while maintaining normal performance on safe inputs.
Fix: VLM-Guard detects jailbreak attacks by identifying critical neurons linked to unsafe behaviors through differential analysis of activation values. The framework monitors a compact set of just a few hundred neurons (less than 0.2% of total neurons) that are strongly correlated with harmful semantics. It operates as a training-free detector, meaning no parameter updates or model fine-tuning is required, making it suitable for practical deployment in safeguarding VLMs.
IEEE Xplore (Security & AI Journals)This research addresses a security problem where images shared on social networks undergo JPEG recompression (a lossy process that reduces file size by discarding some image data), which can destroy hidden messages sent using steganography (hiding secret information inside images). The researchers propose a new method called Robustness-Minimizing Modification (RMM) that identifies which images will survive JPEG recompression with hidden messages intact, allowing non-robust steganographic methods to work reliably on social networks.
Searchable encryption (SE, a technique that lets users search encrypted databases while keeping queries private) can leak information through search and access patterns (what queries are made and which data is accessed). Researchers created Mirage, an attack that recovers both single-keyword and multi-keyword queries by exploiting these leaks while requiring only a small amount of similar documents (0.5% of the database), achieving over 90% accuracy on real-world datasets.
Vision-language models (VLMs, AI systems that understand both images and text) struggle with medical report generation because they need lots of paired training data that are hard to obtain due to privacy concerns. This research proposes Principal In-Context Vectors (PCVs), a method that compresses example demonstrations into compact semantic patterns using principal component analysis (PCA, a math technique that finds the most important patterns in data), which can then guide the model to generate accurate medical reports without needing to retrain it.
Fix: The paper proposes Principal In-Context Vectors (PCVs) as the solution: extract hidden states from auto-regressive VLMs and apply principal component analysis (PCA) to identify robust semantic directions that remain stable under input perturbations, then inject these PCVs into new queries to steer generation toward accurate and clinically meaningful outputs without any model tuning.
IEEE Xplore (Security & AI Journals)This research paper, published in September 2026, addresses how to find the shortest path between two points on encrypted graphs (networks where connections and data are hidden using cryptography) while keeping the query private. The work focuses on path-constrained queries, meaning the shortest route must follow specific rules or limitations, all without revealing the actual graph structure or what users are searching for.