Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
Researchers propose SAFE, an adaptive framework for dynamic facial expression recognition (DFER) built on an Information Bottleneck perspective. It combines a Temporal-aware Augmentation Module, a Spatio-temporal Modeling Module with a sparsity-aware state-space fusion gate, and an Ambiguity-aware Calibration Loss. On the DFEW and FERV39k in-the-wild benchmarks, SAFE consistently outperforms state-of-the-art methods, especially under ambiguous and imbalanced conditions.
The source introduces hardware-based confidential computing as a promising technology for the new threats cloud computing creates. It states that cloud computing changes the threat model while offering many advantages.
This special issue presents a sampler of contextual integrity (CI) applied to real problems. CI is a philosophy-rooted alternative to mainstream privacy definitions, which the source says have struggled with novel threats from powerful digital technologies and have produced ineffective regulation.
The LLL algorithm is described as a fundamental tool in cryptography. The source says it has many applications in cryptanalysis and plays a central role in the security analysis of post-quantum constructions, including Kyber and Dilithium.
This essay surveys the evolution of cybersecurity, from its conceptual origins to contemporary state-sponsored and AI-driven threats. It traces major technical milestones, landmark incidents, and science fiction influences to map the ongoing socio-technical arms race.
DPC-Sharding is a closed-loop adaptive sharding framework for blockchains on dynamic, partially connected IoT and edge networks. It uses Multi-Threshold BFT safety invariants, a clamped sigmoid-based adaptive consensus, and a latency-sensitive state machine to sense network volatility. Experiments against OmniLedger and DynaShard report performance comparable to state-of-the-art synchronous sharding under stable networks and stronger robustness under high node churn and intermittent partitioning.
FirmLocator is an automated framework for fault localization in ARM embedded firmware crashes, addressing the manual post-fuzzing debugging that slows vulnerability triage. It uses event-driven memory footprint collection and history-guided propagation analysis to reconstruct data dependency chains, then scores candidate instructions. Evaluated on 19 ARM firmware binaries and 59 crashing test cases, it localized the root cause within the top 10 instructions with 98.3% accuracy.
Researchers propose DTSM, a digital twin-enabled secure multicast signcryption protocol for multicast command messages sent to UAV swarms over insecure wireless links. The scheme embeds a multicast key in a Lagrange polynomial so each designated UAV recovers it locally, and formal proofs under the random oracle model plus Scyther verification indicate confidentiality, unforgeability, authentication and replay resistance. Evaluation reports significantly lower sender-side communication and computation overhead than related schemes.
Researchers present PSSA, a static analysis framework that detects web vulnerabilities in PHP-based CMS plugins by modeling the CMS framework's context and object-oriented PHP code. Compared with existing tools on established vulnerability datasets, PSSA detects the most vulnerabilities while minimizing false positives. Applied to 980 popular WordPress plugins, it found 178 new vulnerabilities, 124 of them in plugins with over 1 million downloads, and contributed to 82 CVE identifiers being acknowledged.
This research paper proposes the Perspective-Invariant Attack (PIA), which improves the transferability of adversarial examples between black-box DNN models. PIA uses a multi-DOF vertex sampling strategy covering perspective transformations from 2-DOF translation to 8-DOF projective mapping. The authors also present PIA-Mix, an extension that combines this transformation with auxiliary methods, and report that both outperform state-of-the-art transfer-based attacks across DNN architectures, defenses and multimodal LLMs.
OpenAI describes GPT-Red, an automated red-teaming model trained with self-play reinforcement learning to find prompt injection vulnerabilities before deployment. The company says GPT-Red is used to adversarially train GPT-5.6, which it reports as its most robust model to prompt injections, with 6x fewer failures on its hardest direct prompt injection benchmark compared with its best production model from four months earlier.
Researchers propose DSFG-Attack, a transferable adversarial attack against Vision-Language Pre-training (VLP) models that disrupts cross-modal alignment by injecting non-aligned semantics into image-text pairs and restricting perturbations to high-frequency domains for stealth. On Flickr30K image-text retrieval, with TCL as the source model and CLIP_ViT as the target, it raises the black-box attack success rate by an average of 5.08%. The adversarial examples also transfer to captioning and to Multimodal Large Language Models such as GPT-4o and Qwen 2.
Researchers address deepfake detection, where high-fidelity generators remove explicit traces and leave only subtle frequency-domain artifacts. They propose a Hierarchical Spatial-Frequency Fusion (HSFF) module with frequency attention, paired with a Collaborative Multi-Subband Enhancement (CMSE) mechanism that combines Dual-Tree Complex Wavelet Transform (DTCWT) features with pre-trained visual features across six directional subbands. The method reports 97.2% cross-dataset AUROC on Celeb-DFv2 and 89.1% on DFDC.
Researchers introduce ComJail, a compression-aware adversarial framework that jointly optimizes jailbreak prompt generation and compression in a generator-discriminator setup. On AdvBench and JailbreakBench, it reports 74% ASR on GPT-4 and 88% on Gemini-Pro, and remains effective on DeepSeek-V3, DeepSeek-R1, Vicuna-7B, and LLaMA2-13B with shorter prompts.
Researchers propose DFM (Distributed Functional Mechanism), a differentially private training method for shallow single-layer neural networks in multi-user local DP settings. DFM adds calibrated noise to the coefficients of a Taylor-expanded polynomial approximation of the training loss instead of to gradients, as DP-SGD does. In a wireless body area network scenario with heterogeneous data and sensor noise, the authors report up to 10.3% higher reconstruction accuracy than DP-SGD and significantly lower mean training time.
The authors present LACE, a hybrid framework that uses large language models to turn natural-language access control requirements into structured, formally validated rules for IoT platforms. In smart home experiments, LACE reached up to 88% decision accuracy with a 0.79 F1-score using DeepSeek-V3, outperforming GPT-3.5 and Gemini baselines. Ablation and adversarial robustness evaluations indicate that the architecture bounds LLM reasoning errors while keeping authorization behavior stable.
A survey in ACM Computing Surveys (Volume 58, Issue 14, pages 1-39, October 2026) covers fairness, bias, threats, and privacy in recommender systems. The source text provided gives no further detail on its methods or findings.