Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Multi-LLM collaborative systems (setups where multiple AI models work together on complex tasks) can be attacked through three new methods: Decision Poisoning Attack (injecting false instructions to manipulate system output), Indirect Echoleak Attack (extracting private information through model interactions), and Information Collision Attack (exploiting communication between models). While these collaborative systems offer flexibility and better reasoning, their internal communication channels create security and privacy vulnerabilities that attackers can exploit.
Researchers developed a new attack called Distribution Drift Learner (DDL) that can break through non-transferable learning (NTL, a method that prevents AI models from being adapted to new tasks to protect their intellectual property) by only observing the model's input and output responses. The attack works by manipulating how data is distributed across domains and reconstructing training samples, successfully increasing accuracy on protected models from 10% to 81%, exposing serious weaknesses in current model protection strategies.
Cybersecurity uses deception (deliberately creating fake systems or false information to trick attackers) alongside defense and detection, and generative AI makes it easier to create convincing decoys. However, there are currently no well-established methods to measure how well these deception tactics actually work.
Researchers studied how well different versions of major LLMs (like GPT, Llama, and Qwen) resist adversarial attacks, which are inputs designed to trick AI systems into making mistakes, ignoring safety guidelines, or producing false information. They found that newer versions of these models don't always become more resistant to these attacks, and that simply making models larger doesn't guarantee better security.
This research addresses a problem in graph matching (a technique for finding correspondences between similar structures), where training data often contains incomplete or incorrect information. The authors propose a dual-expert framework that uses two different mathematical approaches (KB-QAP and L-QAP, which are optimization methods for assignment problems) working together through an align-fuse-refine pipeline to handle both missing keypoints from partial views and errors from mislabeled data.
A 2025 survey of 704 IT executives found that AI is now the top concern for IT management, ahead of cybersecurity and aligning IT with business goals. While most organizations are increasing IT salaries (90.5%), fewer are hiring new IT staff (54.2%), and cost control has dropped as a priority for measuring how well IT leaders perform.
A banking group implemented a retrieval-augmented AI-powered compliance assistant (a system where AI pulls in external compliance documents to answer questions) to help with regulatory requirements while maintaining human oversight. The article identifies key challenges with this approach, including authority illusion (over-trusting the AI's answers), unclear responsibility for decisions, loss of human judgment about context, and gaps in understanding how the system works, then proposes a four-phase framework to help organizations move from passive AI assistants toward systems where AI and humans reason together.
Federated learning (a system where multiple parties train AI models together while keeping their data private) faces two main problems: model updates can leak sensitive information, and it's hard to detect poisoning attacks (when malicious participants deliberately corrupt the training process). ClusterGuard is a new secure aggregation protocol (a method for safely combining model updates from many participants) that uses clustering, masking techniques, and filtering mechanisms to protect privacy while detecting and resisting poisoning attacks, even when up to 20% of participants are malicious.
Fix: The source proposes ClusterGuard as the solution, which includes: (1) Verifiable Random Function (VRF, a method to ensure fair and transparent grouping of participants) for client clustering, (2) key-homomorphic masking combined with verifiable secret sharing for secure aggregation within clusters, and (3) a dual filtering mechanism based on cosine similarity and norm to detect and resist poisoning attacks. The text notes that ClusterGuard provides two variants for both client-server and decentralized blockchain environments.
IEEE Xplore (Security & AI Journals)Vertical split learning (VSL, a privacy method that divides an AI model between multiple clients and a server) has been found vulnerable to a new stealthy attack called TPA-VSL, where attackers manipulate the embedding model (the part that converts data into numerical vectors) to misclassify targeted samples without leaving obvious signs of poisoning. The attack uses diffusion models (AI systems that generate data by reversing a noise process) and special encoders to trick the system into mapping target data to wrong classes, achieving a 30% higher success rate than existing attacks.
MIDAS is a system for verifying that data stored in the cloud hasn't been lost or corrupted, designed specifically for mobile devices which have limited processing power and battery. The system offloads heavy computational work to edge nodes (intermediate servers between mobile devices and the cloud), allowing mobile devices to do only lightweight verification tasks while maintaining security and accountability.
This research presents a new deep learning model called Complex AFNet that detects atrial fibrillation (AF, an irregular heartbeat condition affecting millions worldwide) from electrocardiogram (ECG, a recording of heart electrical activity) signals. The model converts ECG data into 2D images using mathematical transformations and uses complex-valued convolutions (a type of neural network layer that processes numbers with both magnitude and phase information) to identify subtle patterns that distinguish normal heartbeats from AF episodes, achieving 95.63% accuracy on a standard medical dataset.
PrivateEdit is a system that lets people edit photos of faces while keeping their biometric data (facial features and identity information) private and under their control. Instead of uploading facial images to third-party servers, the system uses on-device segmentation (separating identity-sensitive regions on the user's own device) and masking to hide sensitive facial information before any editing happens, so facial data never leaves the user's device. The system includes adjustable privacy controls that let users decide how much facial information to hide based on their comfort level.
Fix: The source describes PrivateEdit itself as the solution: it uses on-device segmentation and masking to separate identity-sensitive facial regions from editable image context, ensuring biometric data are never exposed or transmitted to third parties. The system includes a tunable masking mechanism that lets users control how much facial information is concealed to balance privacy and image quality based on their trust level or use case.
IEEE Xplore (Security & AI Journals)Researchers developed Urey-ML, a machine learning-based attack that can trick Apple's Ultra-Wideband (UWB, a wireless technology for precise distance measurement) systems into reporting false distances between devices. The attack works by exploiting two weaknesses: an unprotected message during key negotiation (the process of establishing secure communication) that allows the attacker to bypass encryption, and a reinforcement learning algorithm (a type of AI that learns by trial and error) that generates fake signals mimicking normal human movement to fool Apple's defense mechanism.
Researchers developed DUAP (Disentanglement-based Universal Adversarial Perturbation), a method to protect user speech privacy by adding subtle noise to audio that prevents Whisper, a multilingual speech recognition AI, from accurately transcribing what is said. The technique works across multiple languages and remains effective even when audio is compressed or played through speakers in real rooms, addressing privacy risks that earlier protection methods could not handle well in multilingual contexts.
This research paper presents theoretical methods for achieving synchronization (coordinating behavior) in complex-valued memristive neural networks (artificial neural systems with memory-like components that use complex numbers). The authors develop mathematical tools using Lyapunov functionals (equations that measure system stability) and event-triggered controllers (mechanisms that activate only when needed, rather than constantly) to ensure these networks can synchronize globally despite uncertainty and delays in their operations.
This research examines how employees with different roles in organizations perceive people analytics (systems that collect and analyze worker behavioral data to improve efficiency), and discovers that their views are shaped by data ideologies, which are underlying beliefs and assumptions about data and its use. The study found that data ideologies influence whether employees actually use these technologies in practice, operating through three mechanisms: moderation (limiting use), confirmation (supporting existing beliefs), and modulation (adjusting how technologies are applied). Understanding these different ideologies is important for successfully implementing workplace data collection systems.
This research addresses a weakness in neural architecture search (NAS, the process of automatically designing AI model structures) where existing methods focus on average performance rather than worst-case scenarios. The authors propose using a deep generative model (an AI that creates new data) to generate adversarial validation examples (challenging test cases designed to expose weaknesses) and then improve architectures by training them to handle these difficult cases better.
This research proposes a new method called DP-QAM (Differentially Private Quadrature Amplitude Modulation) to solve privacy and communication problems in federated analytics (a system where multiple devices analyze data together without sending raw data to a central server). The method takes advantage of natural errors that occur during data compression and wireless transmission to add extra privacy protection, while balancing privacy, communication efficiency, and accuracy.
This research addresses vulnerabilities in Federated Learning (FL, a system where multiple computers train an AI model together without sharing their raw data), which faces attacks from malicious participants and privacy leaks from gradient updates (the numerical adjustments that improve the model). The authors propose a new method combining homomorphic encryption (a way to perform calculations on encrypted data without decrypting it) and dimension compression (reducing the size of data while keeping important relationships intact) to protect privacy and defend against Byzantine attacks (when malicious actors send corrupted data to sabotage the system) while reducing computational costs by 25 to 35 times.
AdaParse is a framework that can identify the specific settings (hyperparameters, which are configuration values that control how a model behaves) used to create AI-generated images by analyzing those images in detail. Unlike older methods that use a single general fingerprint (a characteristic pattern), AdaParse creates customized fingerprints for each image, allowing it to distinguish between images made with different settings across many different generative models (AI systems that create images).