Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
This paper proposes LLPP, a Lightweight Lattice-based Privacy Protection blockchain framework, to defend against quantum attacks that threaten RSA and elliptic curve cryptography through Shor's and Grover's algorithms. It pairs lattice-based digital signatures with a double encryption mechanism and stores signatures and public keys on IPFS, recording only 46-byte content identifiers on-chain. Evaluations on the Substrate platform report signing and verification latencies below 2 milliseconds.
The paper introduces Trusted Multi-view Noise Refining (TMNR) and its extension TMNR$^{\mathbf{2}}$2 for multi-view learning under noisy labels. The methods use evidential deep neural networks to produce per-view uncertainty-aware opinions, aligned to noisy supervision through noise correlation matrices, and TMNR$^{\mathbf{2}}$2 separates clean and noisy samples into distinct training objectives. Evaluated on 7 multi-view datasets, TMNR$^{\mathbf{2}}$2 reports average accuracy gains of 7% on datasets with 50% label noise.
Mirage is a query-recovery attack against searchable encryption (SE) schemes that leak search and access patterns. Unlike prior attacks that need documents comparable in volume to the database, it works with only partial similar data. With 51 time intervals and 0.5% of similar documents per interval, it reaches 91.6% and 95.4% accuracy on single-keyword queries over the Enron and Lucene datasets, and up to 90.7% and 93.8% on multi-keyword queries.
Researchers propose a robust cover screening method so that hidden messages survive JPEG recompression by online social networks, even when paired with non-robust steganographic embedding. The method, Robustness-Minimizing Modification (RMM), simulates the worst-case effect of embedding on cover robustness, and images unchanged by JPEG recompression after RMM are screened as robust covers. Experiments show such covers exist widely in natural and generated images, and they achieve 100% message extraction at high embedding rates while keeping security comparable to other covers.
Wei Peng, Junmei Ding, Wei Wang, Lei Cui, Wei Cai, Zhiyu Hao and Xiaochun Yun present CTISum, a benchmark dataset for summarizing Cyber Threat Intelligence. The paper appears in Computers & Security, Volume 168, published September 2026.
Researchers propose an adaptive VM allocation framework that uses user threat assessment to reduce side-channel attack risk in cloud environments. They analyze a large-scale Microsoft Azure dataset to guide security-aware initial placement, then apply a non-dominated sorting snow ablation optimizer to dynamically migrate VMs and disrupt co-residency. Experiments report up to 25% lower co-residency risk, up to 20% lower defensive costs, and up to 30% better resource utilization compared with prior adaptive cyber defense approaches.
This paper proposes ABIGX, a unified framework for explainable fault detection and classification (FDC) that extends contribution plots and reconstruction-based contribution to general FDC models. Its core Adversarial Fault Reconstruction (AFR) method treats fault reconstruction as an adversarial attack and introduces a fault index usable for both detection and classification. The authors prove CP and RBC are linear specializations of ABIGX and report that it mitigates fault class smearing, outperforming current gradient-based explanation methods.
Researchers introduce ThinkTrap, an input-space optimization framework that crafts prompts to trigger excessively long or non-terminating generation in LLM services, even under black-box access. Tests on several commercial closed-source LLM services showed consistently abnormal output lengths and response-side degradation. In controlled experiments on private LLM deployments, ThinkTrap cut service throughput to as low as 1% of original capacity and, in extreme cases, caused complete service failure from resource exhaustion.
UAP4MA is a decision-based, problem-space, black-box method for generating universal adversarial perturbations against APT malware attribution models. It uses a multi-agent Multi-Armed Bandit framework that applies functionality-preserving transformations from 13 types. On the AMG43 and APTMalware datasets, it achieves over four times the fooling rate, double the attack success rate, and an 80% reduction in training time compared with state-of-the-art methods.
VLM-Guard is a jailbreak detection framework for Large Vision Language Models that identifies safety-critical neurons linked to harmful semantics through differential analysis of activation values. It isolates a compact set of just a few hundred neurons, less than 0.2% of the total, to build a detector that is lightweight and training-free. The authors report that it detects jailbreak attacks effectively while preserving benign performance in attack-free settings.
This paper proposes SpecShield, a defense against model poisoning in federated learning that actively probes each client model with calibrated adversarial perturbations generated by the Fast Gradient Sign Method on the server. The resulting client responses are analyzed in the frequency domain with the Discrete Wavelet Transform to separate benign from malicious clients, and the authors report consistently higher detection accuracy and robustness than existing defenses across six state-of-the-art poisoning attacks on real-world datasets.
Researchers propose Principal In-Context Vectors (PCVs), a training-free method for medical report generation with vision-language models. The approach extracts hidden states from auto-regressive VLMs, applies principal component analysis to find stable semantic directions, and injects them into new queries without model tuning. Experiments on four MRG benchmark datasets report improved zero-shot and fully supervised generation quality across cross-center, cross-disease, and longitudinal settings.
Researchers propose a facial privacy framework that lets users authenticate for scenarios such as smart building access without exposing their real face or identity in plaintext. The design uses a bidirectional mapping mechanism with an identity mapping module that generates a virtual identity (VID), an identity transfer model that produces a virtual face, and a VIEM module that compares identities in the encrypted domain via homomorphic encryption. Experiments reportedly show a balance between privacy protection, attribute preservation and authentication accuracy.
PathAttack is a path-based, explainable untargeted attack framework for knowledge graph embedding (KGE), where an adversary deletes key triplets or injects malicious triplets to degrade learned representations. It replaces predefined target sets with a triplet discovery approach that combines selection across different KGE model types, and weights multi-hop relational paths for adversarial deletion and addition. Experiments on FB15k-237, WN18RR, and OGBL-WikiKG2 show improved effectiveness, including a 5% gain on WN18RR, and scalability to KGs with millions of entities.
OpenAI introduced Auto-review in Codex, a mode that replaces user approval at the sandbox boundary with review by a separate agent. In an illustrative internal deployment snapshot, Codex sessions stopped for human approval roughly 200x less often than in manual approval mode, and Auto-review approved around 99% of the actions that needed review.
Researchers propose DSCA, a Diffusion-based Semantic Camouflage Attack against person re-identification (ReID). Instead of perturbing pixels, a conditional diffusion generator edits latent attributes such as clothing color and texture to impersonate a target identity, operating zero-query and black-box. Experiments on major ReID benchmarks report attack success rates over 95% in their setting, along with evasion of advanced defenses.
Researchers propose SemBugger, a polymorphic backdoor against Semantic Communication (SC) systems. Unlike earlier monomorphic SC backdoors with a single attack target, it adjusts trigger intensity to produce diverse malicious outputs through a multi-effect poisoning-training framework, while keeping transmission fidelity for benign samples. Experiments on diverse SC models and benchmark datasets report high attack efficacy and a defense that neutralizes the attacks.
Fix: The paper proposes a provable robustness defense that adds controlled noise to SC inputs to resist SemBugger's homogeneous attacks, with a theoretical lower bound on defense efficacy.
IEEE Xplore (Security & AI Journals)PixOOD is a pixel-level out-of-distribution detection algorithm that needs no training on anomalous samples and is not tied to one application. It models in-distribution data with an online data condensation algorithm, which the authors describe as more robust than standard K-means and trainable by stochastic gradient descent, paired with per-class or unified calibration models for the decision strategy. It achieved state-of-the-art results on four of seven datasets and was competitive on the rest.