Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
The RIRplay paper presents a simulated replay-attack speech corpus for voice biometric anti-spoofing, aimed at Physical Access attacks where real audio samples are hard to collect. The authors built it to reproduce the spoofing process across a wide range of acoustic contexts. Training on RIRplay cut the Equal Error Rate on the ASVspoof 2021 evaluation set from 36.89% to 28.04%, compared with models trained on ASVspoof 2019, showing better out-of-domain generalization.
ENClose is an encrypted controller framework for nonlinear closed-loop control systems built on fully homomorphic encryption (FHE). It accelerates functional bootstrapping (FBS) through function segmentation and tree-based encrypted selection, which also limits ciphertext noise accumulation in feedback loops. Experiments report a 3× to 20× speedup over state-of-the-art encrypted controllers, validated on multi-vehicle formation, spring–mass–damper control and anomaly recovery.
Label Hierarchy Transition (LHT) is a deep learning framework for hierarchical classification, which sorts objects into multi-level categories such as order, family, and species. Existing methods split the task into separate multi-class problems, which fails to capture correlations across hierarchy levels. LHT pairs a transition network, which learns label hierarchy transition matrices, with a confusion loss that encourages the classifier to learn cross-level correlations. The authors report that it outperforms current state-of-the-art methods on public benchmarks and extend it to skin lesion diagnosis.
This paper examines how quantum computing changes cybersecurity for critical infrastructure and cloud services, and assesses post-quantum cryptographic solutions. It evaluates quantum effects across nine infrastructure layers, from applications and data through networks, and proposes a security blueprint covering nine critical infrastructure components.
This paper proposes IRCP-f, an improved resilient consensus protocol that defends multi-agent systems against f-local Byzantine attacks. It requires only an undirected, connected graph that is (f + 1)-robust, rather than (2f + 1)-robust as earlier protocols did. The authors also develop a fully distributed differentially private event-triggered average consensus (DPETAC) scheme, with convergence, Zeno behavior, accuracy and privacy analyses, validated by a numerical simulation.
LitCVit is a lightweight self-supervised contrastive Vision Transformer for detecting malicious encrypted traffic without decryption or manually engineered features. The authors report 98.10% average detection accuracy and a 98.08% F1-score on benchmark datasets, with a 2.49% F1 gain over the best prior model and an 8.7x reduction in inference time versus the best existing self-supervised approach.
This paper proposes CIBPU, a conflict-invisible secure branch prediction unit (SBPU). It uses redundant storage, load-aware indexing, replacement design and an encryption mechanism without periodic key updates to keep branch conflicts hidden from attackers. In a gem5 RISC-V model the authors report an average performance overhead of 2.9%–4.0%, and on an FPGA board running SonicBOOM an average degradation of 2.01%.
DiffMI is a diffusion-driven, training-free model inversion attack that recovers identity information from face recognition systems that map facial images to embeddings. The method combines latent code initialization, ranked adversarial refinement, and a confidence-aware optimization objective, and it applies directly to unseen target identities. The authors report 84.42%–92.87% attack success rates against inversion-resilient systems, 4.01%–9.82% higher than the best prior training-free GAN-based approach. The implementation is available at https://github.com/azrealwang/DiffMI.
Researchers propose Adversarial Spectrum Defense (ASD), which uses Discrete Wavelet Transform (DWT) spectral decomposition to analyze adversarial patterns across multiple frequency scales. Combined with off-the-shelf Adversarial Training (AT), ASD+AT reportedly achieves state-of-the-art performance against patch-based and texture-based attacks, outperforming previous defenses by 21.73% in the AP metric, including against adaptive adversaries designed against ASD.
FinBot is a hands-on agentic AI capture-the-flag platform from the OWASP GenAI Security Project's Agentic Security Initiative, described as the "Juice Shop for Agentic AI." It simulates a multi-agent vendor management platform with LLM-driven onboarding, fraud detection, invoice processing and communications, and its challenges map to the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, CWE and MITRE ATLAS. The source positions it as a companion to the Agentic Top 10 framework rather than a replacement.
The OWASP GenAI Security Project's Q1 2026 round-up consolidates major AI-related security incidents and exploit disclosures from January 1 through April 11, 2026. It maps each incident to the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications 2026, and published AI CVEs where applicable. The source reports a shift from theoretical risk to real exploitation, with attackers targeting agent identities, orchestration layers and supply chains.
Asynchronous federated learning is more exposed to Byzantine attacks, and existing defenses fail under data and device heterogeneity. The authors propose Belisa, which compares feature representations of local models against a reference model trained on public data, then clusters to filter out malicious models. Across six datasets, three task types and five Byzantine attacks, Belisa lowers the average test error under attack to 0.42 times that of baselines and speeds aggregation by an average of 12.3 times.
VLBiasBench is a benchmark for measuring social bias in Large Vision-Language Models (LVLMs). It covers nine bias categories plus two intersectional ones (race × gender and race × social economic status). The dataset has 128,342 samples built from 46,848 images generated with Stable Diffusion XL, and the authors evaluated 15 open-source models and two closed-source models.
This work presents the first comprehensive study of adversarial robustness in referring video object segmentation (RVOS) models, which segment text-referred objects in video and matter for safety-critical uses such as autonomous driving. The authors propose xM-ICM, a cross-prompt multimodal attack that jointly corrupts visual and textual embeddings and uses two momentum banks to keep perturbations coherent across clips. Experiments on three benchmarks and five RVOS models report strong white-box attack performance and good black-box transferability.
The paper proposes FedNSA, a secure aggregation protocol for federated learning that combines differential privacy with encryption and multi-party computation. Differential privacy noise obfuscates each client's model update, encryption correlates the noise across clients, and MPC cancels it exactly at the server. The authors claim lower communication and computation overhead than existing encryption- and MPC-based methods, and report experiments on public datasets against state-of-the-art baselines.
TFMD is a secure neural network inference framework built on threshold fully homomorphic encryption, designed to protect model parameters and user inputs. Its protocols support any number n of participants and tolerate up to n-1 corrupted parties under semi-honest security, while computing linear functions with coefficient encoding and ReLU with a proposed protocol. In a three-party setting, its online phase is reported as 2.1 times faster than CrypTFlow (S&P'20).
HENet, a dual-branch generative model, is proposed to build a robust generator-based adversarial attack framework against deep neural networks. Its Adaptive Feature Fusion Module addresses dimension and representativeness mismatches between CNNs and Transformers, while a Dynamic Differentiable JPEG Simulator uses an adaptive quantization mask to improve robustness under JPEG compression. The authors report a better attack success rate, lower perturbation magnitude and higher robustness across target architectures.
HKT-SmartAudit is a framework for building lightweight models for smart contract auditing. It uses a multi-stage knowledge distillation pipeline, combining classical distillation, external domain knowledge and reward-guided learning, to transfer insights from large teacher models into compact student models. The source reports that the distilled models outperform commercial tools and larger models at detecting complex vulnerabilities and logical flaws.