Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
The source is an ACM Computing Surveys article, Volume 58, Issue 10, pages 1-38, published July 2026, titled "Prompting Frameworks for Large Language Models: A Survey." The provided text contains only the publication metadata and no article content, so no findings or methods can be summarized.
The paper proposes a dual adversarial adaptation method with a dynamic labeling mechanism for semisupervised cross-well lithology identification from well log data. It addresses data divergence within wells, which the authors argue existing transfer methods ignore, leading to inaccurate pseudolabels and erroneous label matching across wells. Experiments on actual well log datasets show effective identification when target labels are scarce.
Chat-Scene++ is an MLLM framework that represents 3D scenes as sequences of context-rich object representations paired with identifier tokens, letting LLMs follow instructions across 3D vision-language tasks. It extracts object features using large-scale pre-trained 3D scene-level and 2D image-level encoders and supports grounded chain-of-thought reasoning. Without task-specific heads or fine-tuning, it reports state-of-the-art results on five benchmarks: ScanRefer, Multi3DRefer, Scan2Cap, ScanQA, and SQA3D.
The v5.5.0 release of the MITRE ATLAS knowledge base adds new techniques, including AI Agent Tool Poisoning, AI Supply Chain Rug Pull, Machine Compromise variants, and Cost Harvesting variants. It also adds case studies such as LLMSmith, the Poisoned Postmark MCP Server email exfiltration, and Model Distillation Campaigns Targeting Anthropic Claude, and updates mitigations including Code Signing, AI Telemetry Logging, and Segmentation of AI Agent Components.
This study examines how smartphone users form location privacy concerns through their experiences with device-level location disclosure. The authors extend the privacy calculus model to account for perceived control and both extrinsic and intrinsic influences, and analyze data from 559 smartphone users. They find that perceived device-level privacy control significantly shapes how users assess both the risks and the benefits of location disclosure.
Malware detectors trained on single-process system call traces generalize poorly against polymorphic evasion that splits tasks across threads and processes. The authors propose an entropy-based partitioning of system call logs with a violation-aware penalty that preserves temporal and semantic dependencies, combined with ensemble fusion of submodels trained under heterogeneous adversarial split configurations. Evaluated on ADFA-LD, ADFA-LD-MP and the BarongTrace dataset, the framework reports improved F1-scores, particularly in high-split regimes where conventional models degrade.
This article proposes an integrated framework for optimal tracking control of multi-agent systems with actuator faults. It combines reinforcement learning for the tracking controller, active fault-tolerant control that reconfigures the control law from real-time fault diagnostics, and a control barrier function safety mechanism. The authors report that a low-complexity approach avoids conventional quadratic programming for safety constraints, and that simulations show stable consensus tracking and preserved safety under faults.
Researchers Saleh Alzahrani, Yang Xiao and Sultan Asiri published RanDS, an open dataset of raw ransomware binaries and extracted features, in Computers & Security, available online 25 March 2026. The source text contains only the title, publication date, journal and authors, so the summary is limited to these bibliographic details.
Researchers propose MoEC, a multiobjective ensemble-critic reinforcement learning method for autonomous driving. Each critic in the ensemble follows an independent reward function, and the method pairs a hybrid parameterized action space with an uncertainty-based exploration mechanism that supports hybrid actions. In simulator-based and HighD dataset-based multilane highway scenarios, the method learns policies that balance efficiency, action consistency, and safety.
Organizations may say they prioritize secure development without backing it with secure practices or a security culture. A global survey of coders about their workplaces found gaps in practice, culture, and training.
The paper proposes PATD, a scheme for privacy-preserving auditing and transparent deduplication of UAV data stored in the cloud. It targets integrity checks that do not reveal file contents to the auditor and that confirm deduplication is performed correctly. The source text is an introduction and related-work discussion and does not state the scheme's results.
Max Kaufmann, David Lindner, Roland S. Zimmermann, and Rohin Shah present a conceptual framework for predicting when reinforcement learning training makes chain-of-thought (CoT) monitoring less reliable. The source states that prior results on whether RL degrades CoT monitorability were inconsistent, and that the framework is tested empirically. Its running example is obfuscated reward hacking in coding agents, where a model hides hack-related reasoning from a CoT monitor while still exhibiting the behavior.
This study examines whether anthropomorphic design in AI chatbots changes actual self-disclosure, not just stated intentions. An online experiment with 222 participants manipulated anthropomorphism and measured real disclosure behavior using an ANOVA test and Hayes's PROCESS macro analysis. Anthropomorphism reduced psychological social distance but may trigger the "uncanny valley" effect, privacy concerns reduced disclosure except under high-sensitivity conditions, and trust did not necessarily lead to disclosure.
This paper studies differentially private (DP) zeroth-order methods for fine-tuning large language models, which approximate gradients to avoid the scalability bottleneck of DP-SGD. It proposes two methods: DP-ZOSO, which dynamically schedules key hyperparameters, and DP-ZOPO, which applies data-free stagewise pruning to reduce trainable parameters without extra privacy budget. The authors report theoretical analysis and empirical results on encoder-only and decoder-only language models across diverse tasks.
This paper proposes Tail-Aware Dynamic Adversarial Training (TAD-AT) to improve adversarial robustness when training data follows a long-tailed class distribution. The authors report that class frequency alone does not predict adversarial vulnerability, and that adversarial training under long-tailed data is unstable for tail classes. TAD-AT combines a frequency- and accuracy-aware training loss, a class-wise vulnerability-adjusted attack, and class-adaptive weight averaging, with experiments on long-tailed benchmarks showing significant robustness gains.
PromptGuard is a content moderation technique for text-to-image models that optimizes a universal safety soft prompt in the model's textual embedding space to act as an implicit system prompt. A divide-and-conquer strategy builds category-specific soft prompts into holistic safety guidance. Across five datasets it reduces NSFW generation, reaches an average unsafe ratio of 5.84% and 6.18% under multi-head classifiers and VLM-based guardrails, and runs 3.8 times faster than prior methods.
Korbak and colleagues test whether alignment midtraining, which trains a model on fictional documents depicting aligned AI behavior, generalizes to frontier-style models. They replicate the pipeline of an o4-mini-sized model and compare it against misalignment midtraining from Tice et al. The authors report negative early results: the alignment effect fades after reasoning posttraining and does not carry over to more realistic chat and agentic evaluations.
This paper proposes a clean-label backdoor attack on Graph Neural Networks that injects a single trigger node attached to a target node. The attack misclassifies the target and its one-hop neighbors as the target class without changing their features or labels. Across multiple real-world benchmarks and mainstream GNN architectures, the authors report over 95% attack success rate on target nodes and their neighbors in most settings, including under state-of-the-art defenses.
GDetox is a defense against backdoored graph encoders in graph self-supervised learning (GSSL), the first of its kind per the source. It purifies the encoder through self-supervised distillation without label information, adding adversarial contrastive learning to strengthen the teacher model. Across four node and four graph classification datasets, GDetox reduced the attack success rate to 4% with encoder performance degrading by no more than 2%.
Fix: GDetox: a backdoor defense that purifies a backdoored graph encoder via self-supervised distillation, using adversarial contrastive learning to strengthen the teacher model.
IEEE Xplore (Security & AI Journals)Researchers propose a deepfake face detection method that recasts detection as a Visual Question Answering task for a Visual Language Model. Component-specific prompts direct attention to the eyes, nose and mouth, and a Q-Former module adjusts visual feature focus according to those prompts. The authors report that the method outperforms existing techniques in detection accuracy and robustness, though the source text gives no numerical results.