Research

An LLM defender plans a static honeypot from an application's source code, and a router sends confirmed attackers, including those with working exploits, to an isolated shadow copy. On 40 critical CVE-Bench tasks, the static plan reduced real-target compromise from 26/40 to 5/40 for Claude Opus 4.8 and from 20/40 to 0/40 (31 valid runs) for the ARTEX attack framework. In about half of deception-arm runs, ARTEX's exploit still succeeded on the shadow copy, and ARTEX treated a planted fake secret as genuine on 30 of 120 deception-arm tasks.

JailBound is a jailbreak evaluation framework that builds its benchmark automatically with a fine-tuned meta-attack generator and searches attacks with first-order loss (FOL)-guided dual-branch search. Tested on 46 LLMs from 13 model families, its High-Value Branch improves average ASR over a ZOL-only baseline by 5.1 and 4.9 percentage points across two settings. Its Safety-Sensitivity Branch shows higher behavioral flip rates than the High-Value Branch under local perturbations, indicating greater local sensitivity of judge-assigned safety labels.

A preregistered study compares free-text, structured JSON and HMAC-SHA256-signed requirement manifests for handoffs between LLM subagents, using Qwen3-8B across 1,440 trajectories. Signed manifests cut unsafe commits under attack from 69.4% to 9.0%, but a single adversarial line added before signing raised signed-manifest violations to 14.6% to 75.0% depending on the model, and the signature then authenticated the corrupted manifest.

VIPA is a projector-based adversarial attack that projects optimized patterns onto real-world scenes to make deep image classifiers mispredict. Unlike earlier stealthy methods that model a single static view, it optimizes projections by aggregating simulated attack losses across multiple viewpoints, so the attack holds across views and classifiers. The authors report higher attack success rates than existing methods in targeted and untargeted settings, with minimal perceptual degradation.

This paper presents an adaptive dynamic-watermarking framework for detecting replay attacks on vision-based controllers. A private Gaussian watermark is added to the control input, and a control-conditioned latent dynamics network predicts the expected latent response, with the discrepancy from the received image serving as attack evidence. The framework is evaluated on a vision-guided UR5 manipulation task with a moving human arm, under nominal and replay-attacked observations.

SPILLWAY is a defense for tool-using agents against prompt injection that checks where an action's target comes from. It admits a call when each target value absent from the user's task was returned by a read-only tool in a typed field, or is covered by a fixed delegation rule, instead of relying on a language model's judgment. Across three backbones and seven task suites on one of them, no standard templated injection redirected an action to an attacker's target under SPILLWAY.

SecureGARD is a dynamic ontology-guided governance framework for tool-using LLM agents. It maps heterogeneous tool calls to a shared semantic representation and uses an executable ontology with episode-level task state to issue ready, waiting, or forbidden decisions. Evaluated on AgentDojo, ASB, and AgentDyn under benign and indirect prompt-injection settings, it reports a 0% attack success rate across all three benchmarks while improving task utility under attack.

Researchers show that API distillation campaigns, which spread model-stealing requests across thousands of load-balanced accounts, can be linked through request timing even when content classifiers miss them. Using arrival and stream completion timestamps from a 20 percent seed set, the analysis ranks the remaining accounts of a campaign with 0.92 to 1.00 AUC within 20 minutes across thousands of production accounts. Pinning keys evades this detection but can severely throttle throughput when quotas bind.

Researchers study how safety alignment in large language models depends on a small set of safety-critical neurons and a single refusal direction, so pruning or ablating them can undermine aligned behavior. They propose Addition by Subtraction, which gradually removes identified safety-critical neurons during finetuning and uses preference optimization to restore safe behavior through other model components. Across four models from three vendors, the resulting models resist pruning-based and black-box jailbreak attacks better, with attack success rates reduced by up to 90% for some attacks.

Offline RAG knowledge packs on edge devices are signed, but a signature only proves the publisher, not that the precomputed embedding vectors match the text. Researchers measured how often an attacker controlling the vectors can hijack retrieval, finding up to 5.5% of queries exposed under a near-exact cosine tolerance and 98-100% under a threshold calibrated from CPU INT8-FP32 comparison, with correct answers on a Raspberry Pi 5 dropping from 0.75 to 0.39. Verifying quantisation codes instead of vectors accepted every honest vector in their samples on three platforms.

This technical report addresses backdoor attacks on multi-stage Face Recognition Systems, where training data comes from possibly-compromised third parties while training stays in-house. The authors present three defense techniques against data poisoning-based backdoors: one detects poisoned identities during training or before deployment, and two filter suspicious inputs at inference time. Each is described with its motivation, algorithms and computational impact, and evaluated on realistic face recognition workloads.

The paper argues that digital platforms face three major AI risks: AI control of global platforms, unaccountable AI agents operating anonymously, and unattributed deepfakes. It proposes grassroots contracts, a digital form of an idea from Pierre-Joseph Proudhon, and presents smartphone apps implementing them for a social graph with accountable AI agents and a social network with digital provenance.

CoRTeC releases synthetic tabular data under differential privacy by spending the privacy budget once on a small file of noisy counts, which anyone can decode into synthetic rows at no further privacy cost. A maximum-entropy decoder works without a language model, and at epsilon = 2 it trains classifiers to within 0.02 AUC of a real sample of the same size on the Adult dataset. The strongest membership attack stays far below the bound the budget allows.

Researchers built CASE-Bench, a benchmark of 145 repository-level tasks drawn from real CVEs across 51 projects, to test how repository context affects the security of LLM-generated code. Across 13 context construction methods and six LLMs, functionality-oriented context raised the functional pass rate by up to 8.2 pp but the secure pass rate by at most 3.7 pp. Withholding a safeguard lowered the secure pass rate by up to 8.1 pp, and coding agents observed the relevant safeguard in only 27-36% of trajectories.

This study evaluates twelve configurations of local open-weight language models on ten CyberGym vulnerability-reproduction tasks, three runs each under one harness. Every configuration, down to the 4B model, solves most of the six easier tasks, while the remaining four separate the configurations and the 27B model is required for the harder ones. Quantization left the solved set unchanged in every matched pair but changed speed, and the mixture-of-experts model reached the same scores in less wall-clock time.

This research shows that serving methods which run fewer experts per token in Mixture-of-Experts language models can weaken refusal of harmful requests. Under a jailbreak, harmful compliance rose by 18.4 points on Qwen1.5-MoE, 9.5 on OLMoE and 6.6 on DeepSeek-V2-Lite. The authors introduce SafeStart, which runs all experts for the prompt and the first eight generated tokens, and keeps at least 85% of the offline decode speedup at batch sizes 8 and 32.

KVGuard is a memory-safety checker for the KV cache in LLM serving systems, which use PagedAttention to map requests onto fixed-size physical blocks through a CPU-built block table. It performs five safety checks across the PagedAttention workflow, using compact per-block shadow metadata, and catches the boundary where a violation is introduced. A prototype on vLLM and SGLang covers all 29 historical KV cache safety bugs from the two systems' patch histories, finds 8 previously unknown violations with no false positives, adds 3.0% and 7.4% geomean TPOT overhead on Qwen 2.5 14B, and uses at most 0.11% of KV cache memory.

Baya is a web agent that compiles a user's request into a Python program calling a Trusted Website API before touching the live site, so the planning model never sees untrusted page content. Untrusted data can set values or pick among branches fixed at compile time, but cannot redefine the task or add new operations. On 581 valid WebArena Verified tasks it reaches 77.8% aggregate utility, versus 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct, and it achieves 0% attack success rate on WASP compared with 16.2% and 25.5% for the ReAct baselines.