Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
RobustJudge is an automated, modular framework that systematically tests how robust LLM-as-a-Judge systems are across datasets, prompt templates, judge models, attacks and defenses. The study covers 15 attack methods and 8 defense strategies across 13 models, and finds that LLM-based judges stay susceptible under both pointwise and pairwise protocols. Robustness is highly sensitive to prompt-template and judge-model choice, and optimization-based attacks with long suffixes can substantially inflate scores from both PAI-Judge variants.
The authors propose IF2F, a face anonymization scheme that transforms an original face image into an identifiable, anonymized "self-transformed" face, built on a pretrained StyleGAN inversion encoder and generator. It uses a robust face hashing (RFH) module and a multi-scale conditional latent transformer (MCLT), trained with an auxiliary feature bank strategy and loss functions for anonymity, identifiability and visual quality. Experiments reportedly show it outperforms existing face privacy protection schemes.
The source reports research on interpretable detection and threat characterization of malicious PowerShell scripts, published in the Journal of Information Security and Applications and available online 22 September 2026. Authors Nghi Hoang Khoa, Pham Thai Bao and Van-Hau Pham are listed. The source text provided contains only bibliographic metadata, so the method and findings cannot be summarized beyond the title.
Researchers studied how workers in automation-related sectors anticipate ethical concerns about automation and robotics. Using generative AI to create visual scenarios, they ran a visual Q-study with 90 participants in Australia, South Africa, the United Kingdom, and the United States, who ranked scenarios by how worrying they found them. Three composite views emerged, centred on controlling automation to prevent ecological and security risks, valuing robots while cautioning against close human–robot integration, and concerns about changing work dynamics and inclusivity.
An expert panel at ECIS 2025 in Amman, Jordan, examined real-time data sharing frameworks (RTDSFs), which support low-latency, cross-organisational data flows in finance, healthcare and energy. Through interpretive analysis of the panel transcript and polling of eighteen participants, the authors propose four pillars for Information Systems research: trust, governance, federated intelligence, and security collaboration under cascade risk. Polling results are presented as indicative only, showing alignment on enforceable governance and regulatory engagement.
The authors propose MDAA, a modality- and domain-aware adaptive framework for multimodal domain generalization in face anti-spoofing. It combines a Dynamic Difference Convolution module that adjusts receptive fields to each modality and a Domain-Relation Weighted Multi-Head Fusion module that learns target-source domain relations. The method also extends a vision-language model to RGB, Infrared, Depth and Text inputs, and reportedly outperforms existing methods on four benchmark datasets under cross-domain, modality-missing and limited-source conditions.
SheepHunter is a method that reduces false positives in provenance-based intrusion detection systems (PIDSes), which flag anomalous processes but cannot tell abnormal processes from benign ones with unfamiliar patterns. It represents processes as high-dimensional embedding vectors built from execution context, access control attributes and provenance-graph structure, then classifies processes with high behavior density across dimensions, measured by a community splitting algorithm, as false positives. On two open-source datasets, it reduced false positives by an average of 43.8% for existing PIDSes.
UFOs is an MPC toolkit built for operands whose values span only a few bits, such as 4-bit values in a 16-category task, but which run inside a much larger arithmetic field. Its one-hot vector generator reaches t-log t-1 multiplication gates and ceil(log log t) depth for t=2^k, and its sorting protocol is 3.4x faster online and 1.4x faster offline than Hamada et al.'s radix-sort baseline when sorting 2^16 elements among five parties.
Researchers propose IFSNet, a weakly supervised, prompt-driven framework that enhances image-level privacy in face images by obscuring soft-biometric attributes such as age, gender, and race while preserving identity utility. It needs no per-image sensitive-attribute annotations during training or inference. The authors report that across five face datasets and three identity-labeled datasets, it reduces sensitive-attribute inference while retaining verification performance, measured by equal error rate and false non-match rate, with a favorable privacy-utility trade-off.
FlowUAP is a framework that precomputes type-specific universal adversarial perturbations with a conditional GAN, constrained to a traffic-aware feature space, to evade flow-based network intrusion detection systems. It maps feature-space perturbations to packet-level operations on outbound traffic, avoiding costly per-flow optimization. Experiments on CIC-IDS2018 and ToN-IoT show strong attack effectiveness against diverse NIDS models.
External security researchers found flaws in the machine learning model behind CyberCom's products, CyberComSECURE, CyberComLENS and CyberComSHIELD. The model, trained on historical malware and incident data, could not detect mutated malware files, which exploit its reliance on past data. The source frames this as a case study asking how CyberCom should respond and protect its products against similar attacks.
The source is a bibliographic entry for an ACM Transactions on Privacy and Security article, Volume 29, Issue 4, pages 1-34, November 2026. Its title indicates a study of privacy concerns in gamification using LLM-assisted qualitative analysis with minimal hallucination. The provided text contains no abstract, method, or findings.
This paper presents a thought experiment about a pedagogical twin, a hypothetical educational systems application that does not yet exist. It applies Mason's PAPA ethical framework to the risks of instantiating such a twin and draws on Vallor's virtue ethics to suggest a suitable mindset for the project.
Existing evaluations of AI-based Windows malware detectors differ in training and test data, lack temporal analysis, skip adversarial content-injection tests, and ignore deployment compute costs, so they cannot show which detector to deploy. The authors introduce EXE-Bench, which assesses performance, temporal and adversarial robustness, and computational overhead, combining them into one score for direct comparison. Their analysis finds that feature-engineered domain knowledge remains highly useful, resisting both time and adversarial attacks, while most deep networks excel only right after deployment.
Practical Federated Unlearning (PFU) removes a target client's data contribution from a federated learning global model. It needs only one round of interaction between the target client and the aggregation server during unlearning. The server uses the Fisher Information Matrix to find the parameters most sensitive to that client's data and sends their indices to the client, which estimates its contribution with a Bayesian inference-based method and prunes those parameters, avoiding data or historical updates from other clients.
Researchers investigate why adversarial attacks on graph convolutional skeleton action recognition models transfer poorly across architectures. They propose SVAttack, which combines a spatial gradient damper that suppresses model-specific spatial biases with a viewpoint-based constraint that improves imperceptibility. Across 3 benchmark datasets, 9 models, 7 attack methods and 2 defense methods, the approach significantly improves transferability while keeping skeleton motions visually plausible.
Researchers propose SteerGuard, a framework that uses diffusion models to generate adversarial CAPTCHAs designed to defeat AI-based solvers. Their approach steers the diffusion generation process to embed adversarial semantics directly into CAPTCHA samples, with the aim of reducing manual dataset curation and enabling dynamic updates. The authors report superior transferability, robustness and adaptability across attacker strategies without added runtime cost, including validation on a large-scale online platform.
The paper presents the Advanced Cross-attack Backdoor Detector (ACBD), which detects trigger-injected samples by solving a labeled binary classification task based on disturbance immunity, rather than unlabeled feature clustering. ACBD is trained on one class of a poisoned dataset (1/100 of CIFAR-100) with two classic attacks, using a small LSTM with 53 K parameters and at most 10 clean images for perturbation. The authors report state-of-the-art detection with cross-attack generalization, including on unseen triggers and different target labels.