Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
RLAgent-GSSTI is a grey-box framework for detecting Server-Side Template Injection (SSTI) that combines a Rainbow-and-CodeQL risk prediction method with hierarchical reinforcement learning agents that generate attack payloads. In testing, its static risk prediction reached a 28.10% false negative rate, while several advanced static analysis tools reached 100.00%. The injection detection method outperformed advanced scanners in filtered environments and enabled automated sandbox escapes for remote code execution, with an FNR as low as 11.28%.
Researchers propose Trilobyte, a system that hides encrypted data in the saved game state of single-player games tolerated in censored regions, using shared cloud-synchronized gaming accounts for asynchronous communication. In their inspection-oriented adversary model, where attackers may control gaming platforms and physically inspect devices, they report it can embed up to 5.3 MB in a one-hour session. They also evaluate acquiring accounts through purchases and rentals on Chinese gaming platforms.
ASFuzz is an asynchronous fuzzing system for the Linux kernel that builds a Shadow Dependency Graph to model scheduling relations, context-matched resource relations, and operation types. Its dual-mode design uses coverage-guided exploration of synchronous paths alongside shadow execution that generates legal syscall programs to trigger asynchronous tasks in relevant synchronous contexts. Evaluated on Linux kernel versions 6.6 to 6.15, it found 14 previously unknown concurrency-related bugs, including 10 asynchronous concurrency bugs, and 5 of these have been assigned CVE identifiers.
The paper proposes R3S, a framework for attack-mitigation reasoning in security knowledge graphs, addressing gaps in how existing threat intelligence work models causal links between vulnerabilities and mitigation measures. R3S combines H-AIMG, a hierarchical adversary-informed mitigation graph built from APT ecosystem intelligence, with DPSR, which adaptively fuses semantic and structural candidate rankings using an elbow-point detection on score distributions. Experiments on H-AIMG are reported to validate DPSR's effectiveness.
This paper proposes a unified utility-privacy modeling framework for data sharing that selects only the most informative features satisfying explicit privacy constraints, instead of sharing all attributes or fixed subsets. The trade-off is formulated as a constrained optimization problem, with privacy constraints encoded as weighted penalty terms, and utility gain and privacy loss are estimated via normalized mutual information (NMI). The optimization uses a relaxed dual formulation Lagrangian to characterize the utility-privacy trade-off frontier.
Researchers propose STD-INN, a skeleton-based video anomaly detection method that separates spatial pose configurations from temporal motion dynamics inside normalizing flow architectures. Spatial and temporal components are modeled by dual independent flows, one using graph convolutional networks and one using causal temporal convolutions, linked by a lightweight cross-calibration module. The authors report state-of-the-art performance on benchmark datasets with lightweight parameters and improved interpretability.
This paper proposes BG-FlipIn, a three-player Bayesian game framework for FlipIt-insider models of advanced persistent threats, covering malicious, inadvertent and corrupt insiders. The authors derive a closed-form Bayesian Nash Equilibrium and Nash Equilibria for three deterministic edge cases. Three applications show the defender can make consistent decisions without detecting the insider's specific preference.
Researchers propose CCCC, a covert communication scheme that stays fully compliant with standard TLS 1.3 and so evades auditors who hold the session key and inspect traffic. It uses collision ciphertexts that let one AES ciphertext-tag pair decrypt successfully, and embeds a hidden vector in a standard EdDSA signature during the handshake. The authors formally define the collision ciphertext security properties, give an AES-GCM and EdDSA instantiation, and report a full prototype with only moderate overhead versus standard TLS 1.3.
Researchers propose MGEGOR, a prototype-based open-set specific emitter identification framework inspired by generalized zero-shot learning. It combines contrastive representation learning, prototype-based embedding and multiscale feature extraction with attention alignment to jointly model known and unknown emitters. The method reports significant accuracy gains over state-of-the-art baselines on the LoRa_RFFI dataset and measured datasets.
This paper presents differential fault attacks (DFAs) on FRAST, a stream cipher tailored for Torus-based Fully Homomorphic Encryption (TFHE). Exploiting FRAST's unbalanced Feistel structure, the authors recover the key in one second with 4 or 6 faults under precise fault injection, and in a few minutes under a more practical fault model without extra faults. They describe it as the first fault-type analysis of FRAST.
Alalade, Mayhoub and Matrawy present a privacy threat analysis (PTA) and risk management approach for Smart Home (SH) systems, published in Computers & Security with online availability from 13 August 2026. The source text provided contains only the bibliographic details and no abstract, method or findings, so the research question and results cannot be stated from it.
REI-Net is an end-to-end network that extracts binarized internal fingerprints (IF) and internal sweat pores (ISP) directly from raw 3D OCT volumes, using depth projection instead of slice-by-slice B-scan segmentation. Its two-stage design, a Depth Compressor with a Depth-Breadth Separation Block based on Mamba and a Plane Refiner, reaches state-of-the-art results on the ZJUT-EIFD dataset, with the highest NFIQ 2.0 quality scores for IF and the lowest ISP false detection rates. Total inference time is 605ms.
SpikeTimer is a copyright protection framework for Spiking Neural Networks (SNNs) that uses temporal backdoor learning. It partitions neuromorphic data into timeslices and embeds authorized tokens only within authorized slices, so the model responds correctly to authorized inputs and erroneously to unauthorized ones. Evaluations on multiple neuromorphic datasets report about 10% accuracy on unauthorized data and about 1.5% degradation on authorized inputs, with resistance to fine-tuning and pruning.
DP2-RAG is a framework that adds end-to-end differential privacy to Retrieval-Augmented Generation, covering both the retrieval stage and the generation stage. It introduces Noise-Aware Retrieval with Correction (NARC), which enforces chunk-level DP with calibrated noise and ranking-bias correction, and the Dual Utility-Exponent Mechanism (DUEM), which provides token-level DP for generated surrogates. Evaluated on six benchmarks, it reduces privacy leakage by over 15% relative to strong baselines while keeping near-baseline Top-k retrieval accuracy.
Quantum-KIP compresses a training set into a small set of kernel inducing points with soft labels, using a quantum feature map and forward evaluations only, avoiding backpropagation through quantum circuits. The authors show that replacing one training example changes the learned set and predictions by O(m/n), and they bound privacy-relevant distinguishability under finite-shot and depolarizing noise. On MNIST and CIFAR-10 with six-qubit feature maps, it reaches accuracy close to full-data training with fewer quantum runs and reduced privacy leakage.
The paper presents LOVA, a framework that uses the self-attention weights of LLMs to localize vulnerable lines of code. It reports up to a 5.3× improvement in F1-scores over existing LLM-based approaches, and up to a 14.6× improvement in smart contract vulnerability localization across C, Python, Java and Solidity.
Researchers study whether universal adversarial perturbations (UAPs) can be generated when an attacker controls only the edge portion of a split model, meaning its initial network layers. They introduce edge-only untargeted and targeted UAP formulations that manipulate intermediate features before the split point. On ImageNet, the attacks transfer strongly to the unknown cloud component and compare favorably with classical white-box and black-box techniques.
Researchers propose an RL-based routing scheme for UAVs that uses an LLM to infer environmental and jamming features from multimodal sensing data, along with neighbor location and speed, to choose next hops and relay power. Trust management built from packet forwarding and environmental features selects higher-trust next hops and enables self-healing against gray-hole attacks, while penalizing decisions that trigger frequent path reconstructions. Experiments with a 7-billion-parameter LLaVA model at the control center show performance gains against smart jamming and gray-hole attacks.
Fix: The authors recommend removing the negacyclic restriction in the penultimate round of FRAST and introducing non-zero linear structures into the S-boxes of the last two rounds.
IEEE Xplore (Security & AI Journals)This study tests whether benign parameter-efficient fine-tuning of LLMs affects safety and fairness. Across 235 conversational variants of four instruction-tuned families (Meta-Llama-3-8B, Qwen2.5-7B, Mistral-7B, Gemma-7B) using LoRA, IA3, Prompt-Tuning and P-Tuning, plus 96 coding-task models, benign PEFT produced alignment shifts. Adapter-based methods were generally safer, and Gemma showed the steepest safety decline.
Fix: The source directs practitioners to start from a well-aligned base model, favor adapter-based PEFT, and audit safety and fairness at the category level.
IEEE Xplore (Security & AI Journals)Researchers propose Deep Supervised Adversarial Robust Hashing (DSARH), an end-to-end framework for deep hashing retrieval models. It uses similarity matrices and learnable hash codes to build gradient-based worst-case perturbations for adversarial training. Experiments on cross-modal and image retrieval show that existing deep hashing models are highly vulnerable to adversarial perturbations, while DSARH achieves better robust generalization and improves standard and adversarial performance on image-text benchmarks.
Fix: The proposed mitigation is adversarial training with the DSARH framework, which uses similarity matrices and learnable hash codes to generate worst-case perturbations for robust feature learning.
IEEE Xplore (Security & AI Journals)