Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,003 items
FlowUAP is a framework that precomputes type-specific universal adversarial perturbations with a conditional GAN, constrained to a traffic-aware feature space, to evade flow-based network intrusion detection systems. It maps feature-space perturbations to packet-level operations on outbound traffic, avoiding costly per-flow optimization. Experiments on CIC-IDS2018 and ToN-IoT show strong attack effectiveness against diverse NIDS models.
The authors propose IF2F, a face anonymization scheme that transforms an original face image into an identifiable, anonymized "self-transformed" face, built on a pretrained StyleGAN inversion encoder and generator. It uses a robust face hashing (RFH) module and a multi-scale conditional latent transformer (MCLT), trained with an auxiliary feature bank strategy and loss functions for anonymity, identifiability and visual quality. Experiments reportedly show it outperforms existing face privacy protection schemes.
The source reports research on interpretable detection and threat characterization of malicious PowerShell scripts, published in the Journal of Information Security and Applications and available online 22 September 2026. Authors Nghi Hoang Khoa, Pham Thai Bao and Van-Hau Pham are listed. The source text provided contains only bibliographic metadata, so the method and findings cannot be summarized beyond the title.
Researchers studied how workers in automation-related sectors anticipate ethical concerns about automation and robotics. Using generative AI to create visual scenarios, they ran a visual Q-study with 90 participants in Australia, South Africa, the United Kingdom, and the United States, who ranked scenarios by how worrying they found them. Three composite views emerged, centred on controlling automation to prevent ecological and security risks, valuing robots while cautioning against close human–robot integration, and concerns about changing work dynamics and inclusivity.
An expert panel at ECIS 2025 in Amman, Jordan, examined real-time data sharing frameworks (RTDSFs), which support low-latency, cross-organisational data flows in finance, healthcare and energy. Through interpretive analysis of the panel transcript and polling of eighteen participants, the authors propose four pillars for Information Systems research: trust, governance, federated intelligence, and security collaboration under cascade risk. Polling results are presented as indicative only, showing alignment on enforceable governance and regulatory engagement.
SheepHunter is a method that reduces false positives in provenance-based intrusion detection systems (PIDSes), which flag anomalous processes but cannot tell abnormal processes from benign ones with unfamiliar patterns. It represents processes as high-dimensional embedding vectors built from execution context, access control attributes and provenance-graph structure, then classifies processes with high behavior density across dimensions, measured by a community splitting algorithm, as false positives. On two open-source datasets, it reduced false positives by an average of 43.8% for existing PIDSes.
UFOs is an MPC toolkit built for operands whose values span only a few bits, such as 4-bit values in a 16-category task, but which run inside a much larger arithmetic field. Its one-hot vector generator reaches t-log t-1 multiplication gates and ceil(log log t) depth for t=2^k, and its sorting protocol is 3.4x faster online and 1.4x faster offline than Hamada et al.'s radix-sort baseline when sorting 2^16 elements among five parties.
The authors propose MDAA, a modality- and domain-aware adaptive framework for multimodal domain generalization in face anti-spoofing. It combines a Dynamic Difference Convolution module that adjusts receptive fields to each modality and a Domain-Relation Weighted Multi-Head Fusion module that learns target-source domain relations. The method also extends a vision-language model to RGB, Infrared, Depth and Text inputs, and reportedly outperforms existing methods on four benchmark datasets under cross-domain, modality-missing and limited-source conditions.
Tramy is a dynamic searchable symmetric encryption scheme that lets multiple clients run conjunctive queries over encrypted data and tracks malicious servers, addressing a gap in Dory, which supports only single-keyword queries in a single-client setting. It hides the search pattern through a new primitive called Matrix-based Multi-Point Retrieval and uses a Malice-Defend Bloom Filter that supports conjunctive queries and verifies the integrity of server responses. Benchmarks reportedly show resistance to adaptive adversaries and up to 20x performance improvements over the state of the art.
This paper addresses joint beamforming for covert integrated sensing and communication (ISAC) under dual uncertainties at a passive eavesdropper: imperfect channel state information and unknown noise power. It maximizes radar mutual information while meeting covertness and quality of service requirements. Simulations report that the robust optimization and PPO-RB methods enlarge the feasible covert region while preserving radar sensing, communication quality and covert security in static and dynamic settings.
Researchers propose an attack path discovery method for industrial control systems that combines knowledge-enhanced attack graphs with causal-aware reinforcement learning. The graphs use the MITRE ATT&CK for ICS matrix to generate attack templates, and causal graphs guide weight assignment and policy updates. Experiments on a fluid catalytic cracking simulation platform and two public datasets show the method increases discovered attack paths by 6.65%, 15.50%, and 11.80% over other methods.
External security researchers found flaws in the machine learning model behind CyberCom's products, CyberComSECURE, CyberComLENS and CyberComSHIELD. The model, trained on historical malware and incident data, could not detect mutated malware files, which exploit its reliance on past data. The source frames this as a case study asking how CyberCom should respond and protect its products against similar attacks.
The source is a bibliographic entry for an ACM Transactions on Privacy and Security article, Volume 29, Issue 4, pages 1-34, November 2026. Its title indicates a study of privacy concerns in gamification using LLM-assisted qualitative analysis with minimal hallucination. The provided text contains no abstract, method, or findings.
This paper presents a thought experiment about a pedagogical twin, a hypothetical educational systems application that does not yet exist. It applies Mason's PAPA ethical framework to the risks of instantiating such a twin and draws on Vallor's virtue ethics to suggest a suitable mindset for the project.
Researchers investigate why adversarial attacks on graph convolutional skeleton action recognition models transfer poorly across architectures. They propose SVAttack, which combines a spatial gradient damper that suppresses model-specific spatial biases with a viewpoint-based constraint that improves imperceptibility. Across 3 benchmark datasets, 9 models, 7 attack methods and 2 defense methods, the approach significantly improves transferability while keeping skeleton motions visually plausible.
The paper presents the Advanced Cross-attack Backdoor Detector (ACBD), which detects trigger-injected samples by solving a labeled binary classification task based on disturbance immunity, rather than unlabeled feature clustering. ACBD is trained on one class of a poisoned dataset (1/100 of CIFAR-100) with two classic attacks, using a small LSTM with 53 K parameters and at most 10 clean images for perturbation. The authors report state-of-the-art detection with cross-attack generalization, including on unseen triggers and different target labels.
Existing evaluations of AI-based Windows malware detectors differ in training and test data, lack temporal analysis, skip adversarial content-injection tests, and ignore deployment compute costs, so they cannot show which detector to deploy. The authors introduce EXE-Bench, which assesses performance, temporal and adversarial robustness, and computational overhead, combining them into one score for direct comparison. Their analysis finds that feature-engineered domain knowledge remains highly useful, resisting both time and adversarial attacks, while most deep networks excel only right after deployment.
Researchers propose SteerGuard, a framework that uses diffusion models to generate adversarial CAPTCHAs designed to defeat AI-based solvers. Their approach steers the diffusion generation process to embed adversarial semantics directly into CAPTCHA samples, with the aim of reducing manual dataset curation and enabling dynamic updates. The authors report superior transferability, robustness and adaptability across attacker strategies without added runtime cost, including validation on a large-scale online platform.