Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Adversarial examples (inputs crafted to fool AI systems) are a serious security risk for deep neural networks (AI systems with many layers), especially in physical-world attacks like fooling object detection in surveillance cameras. This research proposes Adversarial Spectrum Defense (ASD), a defense method that uses spectral decomposition (breaking down data into different frequency components) via Discrete Wavelet Transform (a mathematical technique to analyze patterns at multiple scales) to detect and defend against patch-based and texture-based adversarial attacks, and shows it achieves better protection when combined with Adversarial Training (training the AI on attack examples to make it more robust).
Fix: The source proposes Adversarial Spectrum Defense (ASD), which 'leverages spectral decomposition via Discrete Wavelet Transform (DWT) to analyze adversarial patterns across multiple frequency scales' and 'by integrating this spectral analysis with the off-the-shelf Adversarial Training (AT) model, ASD provides a comprehensive defense strategy against both patch-based and texture-based adversarial attacks.' The paper reports that 'ASD+AT achieved state-of-the-art (SOTA) performance against various attacks, outperforming the APs of previous defense methods by 21.73%'.
IEEE Xplore (Security & AI Journals)```json { "summary": "This paper introduces AuthRF, a security system that protects RF sensing models (AI systems that interpret radio frequency signals from WiFi or radar) by using user-specific digital "passports" embedded in the signal processing pipeline. Valid passports allow the model to work correctly, while invalid or fake ones distort the signal and degrade performance, preventing unauthorized use. The approach is designed to be proactive and work during runtime, addressing limitation
Researchers developed DiffMI, a new attack that can recover people's facial identities from face recognition systems by reversing the embeddings (compressed numerical representations of faces). Unlike previous attacks, DiffMI doesn't require expensive training on specific targets and can work against unseen faces and new recognition models, achieving success rates between 84-93% against systems designed to resist such attacks.
This research proposes a new method for private set operations (PSO, techniques that let organizations securely compare or combine datasets without revealing private information) that reduces the computational burden on client devices. The approach uses secret sharing (splitting data into pieces so no single party can see the whole picture) to allow servers to do most of the work while clients can stay offline, making it practical for large-scale collaborative research across institutions like hospitals.
Voice biometric systems (technology that identifies people by their voice) are vulnerable to replay attacks (where an attacker plays back a recorded voice to fool the system), but there hasn't been enough realistic training data to build good defenses. This research created RIRplay, a simulated database that realistically mimics how replay attacks actually happen across different acoustic environments, which improved detection performance significantly when tested on real-world voice spoofing challenges.
Researchers developed AdvFor, a black-box attack method (a way to trick an AI system without seeing its internal workings) that can fool image forgery localization models, which are AI systems trained to detect where images have been fake-edited or manipulated. The attack uses reinforcement learning (a technique where an AI learns by trial and error to maximize rewards) to craft minimal changes to images that make forgery detection fail, using only 7 queries per image, and the researchers tested it on multiple real-world models to show it works effectively.
FinBot is an interactive training platform (CTF, or capture-the-flag exercise) created by OWASP to help developers and security professionals learn about risks in agentic AI systems (AI agents that can plan, act, and make decisions autonomously). It simulates a financial services application where users can practice identifying and defending against attacks like prompt injection (tricking an AI by hiding instructions in its input), tool misuse, data theft, and privilege escalation across multiple connected AI agents.
A Q1 2026 security report by OWASP documents major AI and agentic AI (AI systems that can take autonomous actions) exploits, showing a shift from theoretical risks to real-world attacks targeting AI agent identities, permissions, and supply chains. Key incidents include a Mexican government breach where attackers used Claude to automate reconnaissance and exploitation, affecting 150 GB of sensitive data, along with other incidents involving prompt injection (tricking AI by hiding malicious instructions in its input), privilege abuse, and supply-chain vulnerabilities in AI tools.
This academic survey examines how well large language model-based agents (AI systems that use LLMs to make decisions and take actions) can generalize, meaning how effectively they perform on new tasks or situations they weren't specifically trained for. The paper reviews research across different domains to understand what factors help or limit an agent's ability to adapt and work reliably in unfamiliar contexts.
Asynchronous federated learning (AFL, where multiple devices train a shared AI model without waiting for each other to finish) is faster than synchronous methods but more vulnerable to Byzantine attacks (when some devices send false or corrupted data to sabotage the model). Researchers propose Belisa, a framework that uses feature fingerprints (unique patterns in how local models represent data) to identify and filter out malicious devices, improving robustness and efficiency in real-world scenarios where devices have different data and hardware capabilities.
Fix: The source proposes Belisa as a Byzantine-robust AFL framework that addresses this vulnerability. Belisa works by leveraging a reference model trained on publicly available data to quantify feature fingerprints (discrepancies between feature representations of local models) and filtering out malicious models through clustering. According to the paper, Belisa lowered average test error rates to 0.42x that of baseline methods under attack scenarios and accelerated aggregation by an average of 12.3x compared to other methods.
IEEE Xplore (Security & AI Journals)This research proposes ENClose, a framework that lets control systems (automated systems that adjust themselves based on feedback) operate securely using fully homomorphic encryption, or FHE, a cryptographic method that keeps data encrypted while performing calculations on it. The main innovation addresses two problems: noise building up in encrypted feedback loops and the slowness of doing complex nonlinear operations (calculations that don't follow straight-line relationships) on encrypted data. ENClose uses techniques like function segmentation and tree-based selection to speed up these encrypted calculations by 3 to 20 times compared to previous methods, as demonstrated in real-world tests like vehicle formation control and anomaly recovery.
Large Vision-Language Models (LVLMs, which are AI systems that process both images and text) show promise for general AI but can produce biased outputs, a problem that hasn't been thoroughly studied. Researchers created VLBiasBench, a comprehensive benchmark (a standardized test for measuring performance) that evaluates nine types of social biases in these models, including age, gender, race, and disability status, using 128,342 test samples generated with images and different question formats to assess how biased 17 different LVLMs are.
This paper presents Label Hierarchy Transition (LHT), a deep learning framework designed to improve hierarchical classification, which is the task of sorting objects into multi-level category structures (like organizing a bird into order, family, and species levels). Unlike existing methods that break hierarchical classification into separate classification tasks, LHT uses a transition network and a confusion loss to better capture the relationships between categories at different levels of the hierarchy. The researchers tested their approach on benchmark datasets and a skin lesion diagnosis task, showing improvements over existing methods.
Quantum computing poses a major threat to current security systems because it can break traditional encryption methods that protect critical infrastructure and cloud services. This paper examines how quantum computing affects different layers of infrastructure (from applications to networks) and proposes moving toward quantum-resistant cryptography (encryption methods designed to withstand quantum computer attacks) as a protective strategy. The authors advocate for collaboration across sectors to develop and implement these new security approaches before quantum threats become critical.
This research paper proposes a method to detect FDI attacks (false data injection, where attackers insert fake sensor readings into control systems) by using encoding techniques to transform measurement data into a different mathematical space. The approach aims to catch stealthy FDI attacks that are designed to evade traditional detection methods by disguising themselves as normal system behavior.
Referring video object segmentation (RVOS, the task of identifying and outlining objects in videos based on text descriptions) is used in safety-critical applications like autonomous driving, but the deep neural networks that power these systems are vulnerable to adversarial perturbations (tiny, intentional changes to input data designed to fool AI models). This research demonstrates for the first time that RVOS models can be reliably attacked using a method called xM-ICM, which corrupts both visual and text information to mislead the models, and shows this attack works even when attackers have limited information about the system.
This paper presents HENet, a new method for creating adversarial examples (inputs with small, intentional changes designed to fool AI models) that work against different types of neural networks like CNNs (convolutional neural networks, commonly used for image tasks) and Transformers (a newer architecture). The method improves two key challenges: making attacks work across different model architectures and making adversarial examples survive image compression like JPEG, which currently weakens their effectiveness.
TFMD is a framework that allows multiple parties to run neural networks (machine learning models) on sensitive data while keeping that data private through threshold FHE (fully homomorphic encryption, a cryptographic technique that lets computation happen on encrypted data without decrypting it). Unlike previous systems that only work with a fixed number of participants and fail if too many are compromised, TFMD handles any number of participants, allows up to all but one to be corrupted, and uses special techniques to make the calculations faster, particularly for the ReLU function (a common operation in neural networks).
DFREC is a new method for identifying the original faces used to create deepfakes (fake videos where one person's face is swapped onto another's body). Unlike existing deepfake detection tools that only identify whether an image is fake, DFREC recovers both the source face (the one being used) and target face (the one being impersonated) from a deepfake image, which helps investigators trace who was involved in creating the fake and reduces risks from deepfake attacks. The system uses three components: one to separate source and target face information, one to reconstruct the source face, and one to reconstruct the target face using a Masked Autoencoder (a type of neural network that learns patterns by hiding parts of input data).
This research addresses security challenges in multi-agent systems (networks of multiple autonomous devices communicating together) that operate in open networks and face two threats: Byzantine attacks (where malicious agents try to disrupt the system's decision-making) and eavesdropping (where unauthorized parties steal private data). The authors propose an improved protocol called IRCP-f that defends against Byzantine attacks while preserving privacy, requiring less restrictive network structure constraints than previous approaches and using differential privacy (a mathematical technique that adds noise to data to protect individual information).