Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
Researchers propose CyberOps-Bots, a hierarchical multi-agent reinforcement learning framework for defending cloud networks, with an upper-level LLM agent handling global awareness, human intent recognition and tactical planning, and lower-level RL agents executing atomic defense actions in localized regions. On real cloud datasets, the authors report 68.5% higher network availability than state-of-the-art algorithms and a 34.7% jumpstart performance gain when scenarios shift without retraining.
Researchers introduce a Bayesian ensemble transformer framework for uncertainty-aware network intrusion detection. It splits prediction uncertainty into epistemic and aleatoric components and reports F1-scores of 77.55% to 97.00% across NSL-KDD, CICIDS2017, UNSW-NB15 and SWaT, with ECE between 0.0248 and 0.2278. Under C&W and PGD attacks, performance dropped by 3.6% and 8.0%, respectively.
Researchers propose an intelligent penetration testing method that combines knowledge graph-driven automated scenario construction with historical decision enhancement. The approach generates standardized, realistic test environments and uses a collaborative state temporal processing and action filtering architecture. The experiments report a 69% reduction in average iterations, fewer redundant executions, and more rational decisions.
Argus is a framework for detecting malicious network traffic that addresses concept drift, where changing traffic patterns degrade static detectors. It combines a contrastive learning module for compact traffic representations, drift detection based on category-specific reconstruction loss distributions, and clustering to identify malicious drifting traffic without human intervention. The authors report an average F1 score above 95% across conditions, including extreme drift scenarios.
Existing neural audio steganography requires the sender and receiver to use paired, strictly synchronized models, which complicates deployment and increases leakage risk. The authors propose a synchronization-free framework built on decoupled neural embedding networks that follow a destruction-restoration principle: embedding is a destruction operation, and recovery uses a network from the audio restoration domain. The sender can upgrade, replace, or randomize the embedding network while the receiver still extracts the hidden message, and the authors report reliable extraction under these dynamic changes.
Researchers present UDA-WF, a few-shot website fingerprinting method that uses unsupervised domain adaptation to identify Tor-encrypted websites across domains. It cuts auxiliary data requirements by 95% and pre-training time by 99% versus SOTA methods, reaching 97.37% accuracy in the 20-shot closed-world setting. The method also reaches above 92% and 94% accuracy on the DF and Wang datasets and is reported as more resilient to concept drift and robust to WF defense.
This paper replicates and extends the framework of Willison et al. (2018) on employee computer abuse intentions, testing it with 401 Saudi employees. It applies the replication process of Dennis and Valacich (2014) to examine Organizational Justice Theory, Deterrence Theory, and Techniques of Neutralization. The authors report significant cross-cultural variation in how these mechanisms are perceived, suggesting cultural and policy contexts act as boundary conditions for security behavior.
A survey of 500 U.S. adults, analyzed with partial least squares structural equation modeling, tests why patients hesitate to share personal health information with health information technology. Autonomy of HIT use raises expected positive outcomes and lowers privacy concerns, while perceived tracking raises concerns. Perceived technological and regulatory protections raise expected positive outcomes, and the study ties these evaluations to internal and environmental conditions.
A panel report from the ERCIS Annual Workshop 2025 in St. Gallen, Switzerland, documents how 55 Information Systems scholars reflected on research impact through a World Café format with three breakout sessions. The authors develop a framework that maps six impact themes against the four phases of Benbya et al. (2026): planning, delivering, measuring, and communicating. The matrix is presented as a self-assessment tool, and the findings stress sustained stakeholder partnerships and problem-driven research design.
An interdisciplinary panel of five experts at MWAIS 2024 examined remote patient monitoring (RPM), which uses information and communication technologies to monitor patients' health remotely. The panel found a tension between RPM's potential and its realized value, driven by a distributed health data ecosystem and shifts in health delivery practices. The authors identify research directions and methodological approaches for information systems researchers.
The paper reveals a blind area confusion (BAC) attack that compromises existing single-shot outlier-based detection methods for collaborative perception in autonomous driving, where malicious agents send adversarial messages. It proposes GCP, a Guarded Collaborative Perception framework that combines a confidence-scaled spatial concordance loss with temporal reconstruction of historical bird's eye view motion flows, joined by a spatial-temporal Benjamini-Hochberg test. Experiments report up to 34.69% AP@0.5 improvement over state-of-the-art CP defenses under BAC attacks, and 5-8% under other typical attacks.
DiffHash is a diffusion-based targeted attack against deep hashing models used for large-scale image retrieval. It optimizes the latent representations of images, guided by text generated by a Large Language Model for the target image, and uses a multi-space hash alignment network to map image and text spaces into the binary hash space. The authors report that it outperforms state-of-the-art targeted attacks, with better black-box transferability and more stable results across datasets.
Researchers propose Knowledge Transfer Attack (KTA), a label inference attack against graph-based vertical federated learning (GVFL). KTA infers an active party's private labels using only auxiliary graphs from non-training domains, without the exact class space, the top model, or labeled auxiliary data that prior attacks assumed. The authors report that experiments confirm KTA's effectiveness and its superiority over state-of-the-art attacks.
ParaVul is a framework that combines parallel LLM fine-tuning with retrieval-augmented generation to detect smart contract vulnerabilities more accurately than static analysis and formal verification. It introduces Sparse Low-Rank Adaptation (SLoRA), which inserts parallel sparse and low-rank branches after the attention projection and feed-forward block, and a hybrid RAG system combining Okapi BM25 with dense retrieval. Simulation results report F1 scores of 0.9398 for single-label and 0.9930 for multi-label detection.
Researchers propose ByITFL and LoByITFL, two federated learning schemes that resist Byzantine users while keeping eavesdroppers from learning private user data. Both rely on a small representative dataset held by the federator and a discriminator function that mitigates corrupt users' contributions. ByITFL uses Lagrange coded computing and re-randomization to achieve perfect Information-Theoretic privacy at a significant communication cost, while LoByITFL reduces that cost but needs a Trusted Third Party for a one-time initialization before training.
PVDI is a blind purification method for removing backdoors from deep neural networks. It preserves vital attention to keep core model function and disrupts irrelevant attention to neutralize backdoor behavior during fine-tuning. The source reports significant reductions in attack success rates across diverse datasets and attack scenarios, with utility preserved.
Fix: PVDI, a blind purification method that fine-tunes models to preserve vital attention and disrupt irrelevant attention in order to neutralize backdoors.
IEEE Xplore (Security & AI Journals)FaceReclaim is a diffusion-based framework that tries to restore the original face hidden inside a face-swapped deepfake image, a task the authors call Traceability of Face-swapping Deepfake (TFD). It reformulates TFD as image-to-image editing and uses Multi-Scale Face Attribute Decoupling and Multi-Modal Face Identity Prompting as dual conditioning. The authors report that synthetic faces retain subtle traces of the original face, and they evaluate restoration both visually and through face verification.
A sequential mixed-methods study surveyed 350 working MBA students (averaging 5 years' experience) and 42 information systems graduates on how professionals respond to GenAI integration. Structural equation modeling found GenAI feedback raises self-efficacy and motivation while also increasing perceived devaluation, and skill variety did not predict motivation. The authors extend Job Characteristics Theory and Self-Efficacy Theory and introduce perceived devaluation as a construct grounded in Self-Determination Theory.