Paper Feeds

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08476

AI Summary (中文)

安全聚合（SA）被广泛视为联邦学习中防止模型更新泄露的强大防御机制。然而，在去中心化联邦学习（DFL）中，SA通常被实例化为局部邻域聚合，本文揭示了这种局部性会引发严重的结构性隐私泄露。具体而言，稀疏的去中心化拓扑为共谋的半诚实节点提供了不对称的聚合视图，从而暴露出诚实参与者私有状态的多个隐藏线性组合。由于私有状态和聚合系数均处于隐藏状态，从这些视图中重建私有数据面临根本性挑战。为攻克这一难题，本文首次将该攻击场景与密码学中经典的“隐藏子集和问题”建立了形式化联系，并创新性地提出了一种基于格（lattice）的重建方法。该方法巧妙结合格归约算法与结构过滤技术，成功从复杂的聚合视图中还原出受保护的模型状态。我们在图像、表格和文本任务上，针对稀疏DFL拓扑进行了全面评估。实验结果确凿地表明，共谋的半诚实节点能够精准恢复诚实节点的原始本地更新，进而实现对私有训练数据的下游重建。本研究深刻指出，当局部聚合导致不对称观测时，仅凭安全聚合无法保障DFL的隐私安全。

AI Summary (English)

Secure Aggregation (SA) is widely considered a robust privacy defense in Federated Learning. However, its instantiation as local neighborhood aggregation in Decentralized Federated Learning (DFL) introduces critical structural vulnerabilities. This paper demonstrates that sparse DFL topologies create asymmetric aggregate views for colluding semi-honest nodes, exposing hidden linear combinations of honest participants' private states. To address the fundamental challenge of reconstructing states when both the private updates and aggregation coefficients are completely hidden, we establish a formal connection to the Hidden Subset Sum Problem in cryptography. Building on this theoretical formulation, we propose a novel lattice-based reconstruction attack that strategically combines lattice reduction with structural filtering to recover protected model states. Extensive evaluations across image, tabular, and text tasks under sparse topologies reveal that colluding nodes can accurately reconstruct the original local updates of honest participants, ultimately enabling the downstream recovery of private training data. Our findings conclusively show that SA alone fails to guarantee privacy in DFL when local aggregation induces asymmetric observations.

Abstract

Secure Aggregation (SA) is widely regarded as a strong defense against model-update leakage in Federated Learning (FL), as it reveals only aggregate results while hiding individual updates. In Decentralized Federated Learning (DFL), SA is commonly instantiated as local neighborhood aggregation, where each node obtains a weighted aggregate over its neighbors. We show that this locality creates a structural leakage surface: sparse decentralized topologies provide colluding semi-honest nodes with asymmetric aggregate views, exposing multiple hidden linear combinations of honest participants' private states. Reconstructing private states from these aggregate views is fundamentally challenging, as both the private states and the aggregation coefficients are hidden. We tackle this challenge by establishing a formal connection to the Hidden Subset Sum Problem, a long-studied problem in cryptography. Building on this formulation, we design a lattice-based reconstruction approach that combines lattice reduction with structural filtering to reconstruct protected model states. We evaluate our attack on image, tabular, and text tasks under sparse DFL topologies. Our results show that colluding semi-honest nodes can recover the original local updates of honest nodes, enabling downstream reconstruction of private training data. These findings demonstrate that SA alone does not guarantee privacy in DFL when local aggregation induces asymmetric observations.

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08394

AI Summary (中文)

背景：工业级Windows恶意软件检测器通常被视为由规则机制及机器学习驱动的静态和动态分析等异构组件组成的“复合AI系统”。然而，受限于工业保密性，其内部架构难以被系统评估准确性、计算成本及对抗鲁棒性。相比之下，学术研究虽具备透明度，但多孤立地评估单一检测组件。

方法与创新：为弥合学术研究与工业实践的鸿沟，本文受先进工业架构启发，提出了一种新颖的研究方法。首先，该方法显式地平衡了检测性能、计算需求与对抗鲁棒性三者之间的权衡；其次，引入了系统级威胁模型，旨在捕捉攻击者如何利用不同程度的先验知识来规避整个复合AI系统，而非仅仅针对单一检测器。

主要发现：基于真实世界数据的实验表明，优化后的复合AI系统能够显著缩短训练时间并提升系统响应速度，且检测性能的损失微乎其微。此外，威胁建模分析揭示，掌握更多信息的攻击者能够构造更有效的对抗样本，这不仅暴露了系统的优劣势并降低了其响应能力，还深刻揭示了系统效率与鲁棒性之间存在直接的权衡关系。

结论：最后，本文将上述复杂的权衡转化为实用的部署指南与核心建议，协助安全从业者根据实际运营约束，精准选择最契合的恶意软件检测系统。

AI Summary (English)

To bridge the gap between isolated academic research and opaque industrial practices, this paper proposes a novel methodology for evaluating Windows malware detectors as Compound AI Systems, introducing a framework that explicitly balances the critical trade-offs among detection accuracy, computational efficiency, and adversarial robustness. Additionally, we develop system-level threat models to simulate how attackers with varying degrees of prior knowledge exploit the entire architecture, demonstrating through real-world experiments that our optimized system significantly reduces training time and improves responsiveness with only marginal detection accuracy loss. Furthermore, our analysis reveals that highly knowledgeable attackers can craft effective adversarial examples that expose a direct trade-off between system efficiency and robustness, ultimately allowing us to translate these empirical findings into actionable deployment guidelines to help practitioners select systems that best match their operational constraints.

Abstract

Industrial Windows malware detectors are commonly described as Compound AI Systems composed of multiple heterogeneous components, including rule-based mechanisms as well as machine-learning-based static and dynamic analyses. However, due to industrial secrecy and limited public disclosure, the internal architectures of these systems can only be inferred, rendering systematic evaluations of detection accuracy, computational costs, and adversarial robustness largely infeasible. In contrast, academic research provides reproducible and transparent evaluation methodologies, but typically investigates individual detection components in isolation. To bridge the gap between academic research and industrial practice, and inspired by state-of-the-art industrial architectures for Windows malware detection, we propose a novel methodology that (i) explicitly balances the trade-off among detection performance, computational requirements, and robustness, and introduces (ii) system-level threat models that capture how attackers exploit different degrees of knowledge to evade the entire Compound AI System rather than isolated detectors. Experiments conducted on real-world data demonstrate that the Compound AI System training time can be reduced and responsiveness improved while incurring only a marginal loss in detection performance. Leveraging our threat modeling, we show that increasingly knowledgeable attackers craft more effective adversarial examples, revealing the system's strengths and weaknesses, degrading its responsiveness, and exposing a direct trade-off between efficiency and robustness. Finally, we translate these trade-offs into take-home messages and deployment guidelines, helping practitioners to select the system that best matches their operational constraints.

HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08306

AI Summary (中文)

本文提出了一种名为 HoneyRoute 的推理服务层，旨在检测针对大语言模型（LLM）的恶意请求，并将其路由至专用蜜罐模型，从而在保护生产模型的同时持续收集攻击者情报。现有防御机制通常将陷阱嵌入模型内存或在协议层重建欺骗，导致服务层缺乏保护且无法将反馈用于检测。为此，HoneyRoute 创新性地耦合了三大核心组件：(1) 流式路由器（基于冻结的0.8B嵌入主干和按域划分的MLP头）；(2) 双重实现蜜罐（基于规则/提示工程的代码蜜罐或同家族专用副本）；(3) 分析循环（将捕获的交互转化为攻击者指纹以重新训练路由器）。在生产数据流和七域攻击语料库上的实验表明，HoneyRoute 在仅增加 38 毫秒中位延迟的情况下达到了 0.911 的 F1 分数。它以 1/385 的延迟实现了双层防护 LLM 级联 96% 的性能，并在 13 种对抗性变换下保持 0% 逃逸率。此外，分流恶意请求可使生产模型在并发攻击下的 token 消耗降低 97.8%。训练副本对 92.9% 的良性请求与生产模型保持一致。最后，循环训练的校正头将合法安全研究的误路由率降低了 9 倍，检测 F1 提升至 0.933。本研究为对抗性 LLM 服务提供了高效、低延迟且具备自适应进化能力的防御新范式。

AI Summary (English)

We introduce HoneyRoute, an inference-serving layer designed to detect and route malicious requests in Large Language Model (LLM) deployments to dedicated honeypot models, shielding production systems while harvesting attacker intelligence. Unlike existing defenses that leave the serving tier unprotected, HoneyRoute integrates a streaming router, a dual-implementation honeypot, and an analysis loop that converts trapped interactions into attacker fingerprints for continuous router retraining. Extensive evaluations demonstrate that HoneyRoute achieves an F1 score of 0.911 with only 38 ms median added latency, matching 96% of a two-tier guard-LLM cascade at 1/385th of its latency while maintaining a 0% evasion rate under 13 adversarial transformations. Furthermore, diverting malicious traffic reduces production token consumption by 97.8% during concurrent flooding attacks, and a loop-trained correction head significantly minimizes the misrouting of legitimate security research by 9x, boosting the detection F1 to 0.933. Ultimately, this approach establishes a highly efficient, low-latency, and adaptively evolving defense paradigm for adversarial LLM serving environments.

Abstract

We introduce HoneyRoute, an inference-serving layer that detects whether an incoming request is malicious and, if so, routes it to a dedicated honeypot model, shielding production while the adversary's interaction is continuously harvested for intelligence. Existing defenses embed traps inside model memory or rebuild deception at the protocol layer, leaving the serving tier unprotected and feeding nothing back into detection. HoneyRoute couples (i) a streaming router (a frozen 0.8B-embedding backbone with per-domain MLP heads), (ii) a dual-implementation honeypot (a rule/prompt-engineered code honeypot or a dedicated same-family replica), and (iii) an analysis loop that converts trapped interactions into attacker fingerprints for router retraining. On a production trace plus a seven-domain attack corpus, the router reaches F1=.911 at 38 ms median added latency, matching 96% of a two-tier guard-LLM cascade's F1 at 1/385 of its latency with 0% evasion under 13 adversarial transformations; diverting the malicious share cuts production-model token consumption under concurrent flooding with real GCG-suffix payloads by 97.8%; the trained replica agrees with the production model on 92.9% of benign holdout requests, while naive unconditional bait injection collapses to 7.6% and selective camouflaged injection recovers to 88.9%, mapping the recoverable fidelity-traceability frontier; and a loop-trained correction head cuts misrouting of legitimate security research 9x while raising detection F1 to .933.

Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08236

AI Summary (中文)

背景：自动安全评判系统（如 Llama Guard 或 GPT-4o）生成的数据被广泛用于评估大语言模型的越狱成功率、防御效果及安全排行榜。然而，这些评判系统究竟是依据回复的实质内容还是表面风格进行安全判定，仍是一个关键问题。

方法：本研究提出“内容不变的风格包装”方法。在保持模型回复主体内容逐字节不变的前提下，为其添加仅改变语气的固定字符串（如教育免责声明、伪造的安全推理块、或带有拒绝前缀的有害内容），以及将无害拒绝包装成危险语气的框架。通过在 JailbreakBench 数据集上对 600 个回复应用多达 7 种包装形式，并测试 8 个主流安全评判器，量化评判结果的翻转率。

主要发现：虽然多数评判器表现稳定，但特定评判器存在极易被利用的盲点。例如，仅添加“拒绝前缀”包装就导致 GPT-4o-mini 19.9% 的正确“不安全”判定发生翻转；部署版的 Llama Guard 4 更是被确定性欺骗，其 12.3% 的有害判定因“教育课程”框架被误判为安全。相反，gpt-oss-safeguard-20b 对此免疫，且仅重写评分提示词就能将攻击成功率降低十倍，证明漏洞源于评判器本身。

创新点：双人人工验证确认了 100% 的内容不变性，并证实 90% 的翻转纯属评判器错误。本研究揭示了安全评判器的脆弱性，并开源了相关数据集、代码及包装器。

AI Summary (English)

Background & Method: Automatic safety judges are critical for evaluating LLM security, yet it remains unclear whether they assess the actual content or merely the stylistic presentation of responses. To investigate this, we introduce "content-invariant style wrappers"—such as educational disclaimers, fake reasoning blocks, or deceptive framing—that alter only the tone while preserving the core reply byte-for-byte.

Key Findings: Evaluating over 600 JailbreakBench responses across 8 judges, we reveal that while most judges remain robust, specific deployed models harbor easily exploitable blind spots. For instance, a token-refusal wrapper flips 19.9% of GPT-4o-mini's correct unsafe verdicts, and an "educational course" framing deterministically tricks Llama Guard 4 into flipping 12.3% of its harmful verdicts to safe.

Contribution: Human validation confirms that 90% of these flips are pure judge errors, proving the vulnerability lies within the judge rather than the content itself, and we release the complete dataset, wrappers, and code to advance robust safety evaluations.

Abstract

Automatic safety judges -- systems such as Llama Guard or a GPT-4o grading prompt that decide whether a model's reply is harmful -- produce the numbers behind almost every reported jailbreak success rate, defense evaluation, and safety leaderboard. We ask whether these judges grade what a reply contains or how it sounds. We keep a reply's content fixed and add content-invariant style wrappers: fixed strings placed before or after the reply that change only its tone (an educational disclaimer, a fake safety "reasoning" block, a token refusal followed by the unchanged harmful body), or, on harmless refusals, framing that merely sounds dangerous. The body is preserved byte-for-byte, so a faithful judge must return the same verdict, and any flip is an error of the judge, not a change in safety. Over 600 JailbreakBench replies x up to 7 forms x 8 judges, we measure flip rates with paired significance tests and measured noise floors. Findings are precise rather than universal: most judges barely move, but specific judges harbor cheaply exploitable blind spots. A token-refusal wrapper flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts (noise floor 0.5%; 18.2% under majority-of-three re-scoring) yet moves Claude only 0.4%. The deployed Llama Guard 4 is deterministically gamed: an "educational course" framing flips 12.3% of its harmful verdicts to safe. A second deployed guard (gpt-oss-safeguard-20b) is immune, and rewriting only the grading prompt (StrongREJECT-style) cuts the attack tenfold on the identical model -- the vulnerability lives in the judge, not the content. A two-annotator human validation confirms 100% content invariance and 90% of flips as judge errors (kappa 0.95-1.0), and a bootstrap shows the underlying model ranking is already unstable to sampling alone. We release the dataset, wrappers, code, and per-verdict labels.

Geographically Regularized AUC-Maximizing Personalized Federated Learning

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08379

AI Summary (中文)

背景：在传染病爆发期间，构建准确的诊断与风险预测模型对于支持临床决策至关重要。然而，由于严格的隐私保护和数据治理要求，医疗机构之间难以共享患者级别的数据。此外，不同机构间的数据分布往往存在显著的异质性。同时，受试者工作特征曲线下面积（AUC）作为评估模型判别性能的核心指标，直接在模型开发中对其进行优化具有重要的临床价值。

方法：针对上述挑战，本研究提出了一种基于地理正则化AUC最大化的个性化联邦学习框架（GrAUC-PFL）。该方法在确保患者数据不出本地的前提下，直接优化平滑的成对AUC代理损失函数，以学习个性化预测模型，并有效应对医疗机构间的异质性。创新性地，该框架引入了基于图的正则化机制，利用地理空间信息，鼓励地理位置相邻的医疗机构学习相似的模型系数向量，从而在保持模型个性化的同时，充分利用地理邻近机构间的潜在相似性。

结果与结论：通过广泛的模拟实验与真实世界数据应用，结果表明 GrAUC-PFL 显著提升了模型的判别性能。特别是当地理上相邻的医疗机构具有相似的数据生成特征时，该方法的性能优势更为突出。本研究为跨机构的医疗预测模型构建提供了一种兼顾隐私保护、数据异质性与空间相关性的有效新范式。

AI Summary (English)

Accurate diagnostic and risk-prediction models are crucial for clinical decision-making during infectious disease outbreaks. However, strict privacy constraints and significant data heterogeneity across healthcare institutions severely limit centralized data sharing. To address these challenges, we propose Geographically Regularized AUC-Maximizing Personalized Federated Learning (GrAUC-PFL), a novel framework that directly optimizes a smooth pairwise AUC surrogate to learn personalized models while keeping patient-level data strictly local. Innovatively, our approach incorporates a graph-based regularization mechanism that leverages spatial information, encouraging geographically neighboring institutions to share similar coefficient vectors without compromising model personalization. Extensive simulations and real-world data applications demonstrate that GrAUC-PFL significantly enhances discriminative performance compared to existing methods. Notably, the performance gains are particularly substantial when geographically adjacent institutions exhibit similar data-generating characteristics. Ultimately, this study provides a robust, privacy-preserving paradigm for developing personalized predictive models in heterogeneous, multi-institutional healthcare networks.

Abstract

Accurate diagnostic and risk-prediction models are important for supporting clinical decision-making during infectious disease outbreaks. However, privacy and governance requirements may restrict patient-level data sharing across healthcare institutions, and data distributions often vary. Moreover, AUC is widely used to evaluate discriminative performance, motivating its direct optimization in model development. We propose geographically regularized AUC-maximizing personalized federated learning (GrAUC-PFL), which directly optimizes a smooth pairwise AUC surrogate to learn personalized models while keeping patient-level data local and accounting for institutional heterogeneity. Graph-based regularization encourages geographically neighboring institutions to have similar coefficient vectors while retaining a personalized models. Simulations and a real-data application suggest improved discriminative performance, particularly when geographically neighboring institutions have similar data-generating characteristics.

AgentGrad: Intervention-guided Prompt Optimization for Multi Agent Systems

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08572

AI Summary (中文)

基于大语言模型（LLM）的多智能体系统（MAS）通过采用多个专业智能体实现了卓越性能，但其表现高度依赖于提示词设计。在MAS提示词优化中，利用自然语言反馈指导更新的“文本梯度”方法已成为主流范式。然而，现有方法在梯度提取和聚合阶段存在明显局限：提取时未验证修改是否真能解决失败，且缺乏对中间输出的智能体级别监督；聚合时随机拼接独立梯度，混合了无关失败模式，导致泛化能力差。

为解决上述问题，本文提出 AgentGrad，一种基于顺序干预和语义文本梯度抽象的MAS提示词优化框架。针对每次失败，顺序干预机制逐一修改智能体行为，精准定位能解决问题的目标智能体，并将其修改后的输出作为监督信号提取细粒度梯度。语义文本梯度抽象则对相似梯度聚类，防止无关模式混合，并抽象出捕捉共同纠正模式的泛化梯度。实验表明，AgentGrad 在五个 MAS 基准上均取得最先进（SOTA）性能，且实际优化时间平均减少 2.5 倍。

AI Summary (English)

While text-based gradient methods are a leading paradigm for optimizing prompts in Large Language Model-based multi-agent systems (MAS), existing approaches suffer from critical limitations where gradient extraction lacks failure-resolution verification and agent-level supervision, and gradient aggregation randomly concatenates individual gradients, thereby mixing unrelated failure modes and severely degrading generalization. To address these challenges, we propose AgentGrad, a novel prompt optimization framework based on sequential intervention and semantic textual gradient abstraction. Specifically, AgentGrad employs sequential intervention to precisely identify the target agent whose modification resolves a specific failure, utilizing its modified output as agent-level supervision for fine-grained gradient extraction. Furthermore, it clusters semantically similar gradients to abstract generalized corrective patterns, effectively preventing the mixing of unrelated failure modes and ensuring robust prompt updates. Experimental results demonstrate that AgentGrad achieves state-of-the-art performance across five MAS benchmarks and significantly improves overall efficiency, reducing average wall-clock optimization time by $2.5\times$ compared to the next-fastest baseline.

Abstract

Large language model (LLM)-based multi-agent systems (MAS) achieve strong performance by employing specialized multiple agents, yet their performance depends on the prompt design of each agent. For MAS prompt optimization, textual gradient methods that guide prompt updates using natural-language feedback have emerged as a leading paradigm. In this paper, we identify limitations in two stages of existing textual gradient approaches: gradient extraction and gradient aggregation. In gradient extraction, previous works select a target prompt without verifying whether modifying it resolves the failure, and derive gradients without agent-level supervision over the corresponding agent's intermediate output. In gradient aggregation, individual gradients are randomly grouped and concatenated, often mixing unrelated failure modes and producing prompts that fail to generalize. To address these limitations, we propose \textbf{AgentGrad}, a prompt optimization framework for multi-agent systems based on sequential intervention and semantic textual gradient abstraction. For each failure, sequential intervention modifies the behavior of one agent at a time to identify the target agent whose modification resolves the failure. The modified output of the target agent then serves as agent-level supervision for extracting a fine-grained gradient. Semantic textual gradient abstraction clusters semantically similar gradients to prevent mixing unrelated failure modes, and abstracts each cluster into a generalized gradient that captures the shared corrective pattern. Experimental results show that AgentGrad achieves state-of-the-art performance across five MAS benchmarks and reduces wall-clock optimization time by $2.5\times$ on average compared to the next-fastest baseline.

Security Properties of Iterated Random Functions

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1923

AI Summary (中文)

在许多密码学应用中，对哈希函数进行迭代操作是一种常见做法，主要用于增强对各类攻击的抵抗力（例如在密码哈希中减缓字典攻击）。尽管非迭代密码哈希函数的安全属性已被广泛研究，但其迭代变体受到的关注相对较少。即使在随机预言机模型（ROM）下，迭代哈希函数的原像抗性和抗碰撞性也尚未得到完全刻画。先前的研究要么限制了敌手的预言机访问权限，要么仅关注最后一次迭代步的原像寻找。

本文全面完善了这一领域的研究图景，针对被建模为随机预言机的随机函数 $H$ 的 $k$ 次迭代 $H^k$，给出了原像抗性和抗碰撞性的具体攻击方案及匹配的安全上界。研究发现，迭代操作对抗碰撞性几乎没有影响；然而，对于原像抗性，情况则截然不同。具体而言，本文提出了一种针对 $H^k$ 原像抗性的具体攻击，在敌手查询次数 $q = \Omega(k)$ 的假设下，该攻击的优势达到了 $\Omega(\frac{qk}{n})$。同时，本文证明了 $\mathcal{O}(\frac{qk+k^2}{n})$ 的安全上界，该上界在 $q = \Omega(k)$ 区间内是紧确的。此外，研究还表明，迭代操作仅在 $H$ 为一般随机函数时会削弱原像抗性；当 $H$ 为置换（permutation）时，其原像抗性基本保持不变。

AI Summary (English)

Iterating cryptographic hash functions is common for enhancing security, yet the preimage and collision resistance of iterated hash functions remain incompletely characterized, even in the random oracle model (ROM). Prior works either restricted adversary access or focused solely on the final iteration step. This paper completes the security picture for an iterated random function $H^k$, where $H$ is modeled as a random oracle, by providing concrete attacks and matching upper bounds. We demonstrate that while collision resistance is essentially unaffected by iterations, preimage resistance is significantly impacted. Specifically, we present an attack on the preimage resistance of $H^k$ achieving an advantage of $\Omega(\frac{qk}{n})$ when $q = \Omega(k)$, where $q$ is the number of queries. We complement this with a tight upper bound of $\mathcal{O}(\frac{qk+k^2}{n})$ in this regime. Finally, we show that this degradation in preimage resistance is specific to random functions; when $H$ is a permutation, preimage resistance remains essentially unaffected.

Abstract

Iteration of a cryptographic hash function is a common practice in many applications, typically used to enhance resistance against various attacks (e.g., to slow down dictionary attacks in password hashing). While the security properties of (non-iterated) cryptographic hash functions are well studied and understood by the cryptographic community, their iterated counterparts have received comparatively little attention. Even in idealized models such as the random oracle model, preimage and collision resistance of an iterated hash function do not seem to be fully characterized.

The security of an iterated random function has mainly been studied through its indistinguishability from the (non-iterated) random function. Bhaumik et al. (ASIACRYPT 2017) analyse the collision resistance of an iterated random function, but in a model where the adversary has oracle access to the iterated random function (and not the random function itself). Kogan et al. (CCS 2017) then study the preimage resistance of an iterated random function in the random oracle model, but focus only on finding preimages for the last iteration step.

In this paper we complete the picture by providing attacks and matching upper bounds for preimage and collision resistance of an iterated random function $H^k$, where $H \colon [n] \to [n]$ is modelled as a random oracle. While collision resistance is essentially unaffected by iterations, we prove that the situation is very different in the case of preimage resistance. Specifically, we present a concrete attack on preimage resistance of $H^k$ with advantage $\Omega(\frac{qk}{n})$ assuming $q = \Omega(k)$, where $q$ denotes the number of $H$-oracle queries made by the adversary. We complement our attack with an upper bound $\mathcal{O}(\frac{qk+k^2}{n})$, which is tight in the $q = \Omega(k)$ regime. Finally, we show that iteration weakens preimage resistance only for random functions: when $H$ is a permutation, preimage resistance remains essentially unaffected.

Pairing-based Succinct Half-Chosen VOLE

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1922

AI Summary (中文)

背景：简洁非交互式半选择向量不经意线性扩展（Succinct Non-Interactive Half-Chosen VOLE, 简称 NIHC-VOLE）是现代密码学中一种关键的原语。它允许拥有长度为 $n$ 的向量 $\boldsymbol x$ 的发送方与拥有标量 $y$ 的接收方，通过同时交换简洁的消息，高效建立 $\boldsymbol x \cdot y$ 的加法秘密共享。近期的前沿研究在多种密码学假设下实现了通信复杂度为 $O(n^{2/3} \lambda)$ 的 NIHC-VOLE 方案，或基于 LWE 假设实现了多对数级别的通信复杂度。

方法与创新：本文深入探讨了如何利用双线性配对（bilinear pairings）技术来优化和改进基于群的 NIHC-VOLE 方案，并在两种不同的设置下取得了突破性进展：
1. 公共设置（Public Setup）：我们提出了一种全新方案，将其在线通信复杂度大幅降低至 $O(\sqrt{n \log n})$ 个群元素。该方案的安全性基于一种全新的类 BDDH（Bilinear Decisional Diffie-Hellman）假设。
2. 指定接收方设置（Designated Receiver Setup）：在此设置下，我们的方案实现了极致的在线通信效率，在线通信量仅需 3 个群元素，同时支持 $O(n)$ 个群元素的可重用离线通信。该方案的安全性严格建立在双线性 power DDH 假设之上。

主要发现：通过创新性地引入双线性配对，本论文显著降低了 NIHC-VOLE 的在线通信开销，为安全多方计算和隐私保护协议提供了更高效的底层密码学工具。

AI Summary (English)

Background: Succinct Non-Interactive Half-Chosen VOLE (NIHC-VOLE) enables a sender with a vector $\boldsymbol x$ and a receiver with a scalar $y$ to establish additive shares of $\boldsymbol x \cdot y$ via succinct message exchanges. Recent works achieved $O(n^{2/3} \lambda)$ or poly-logarithmic communication complexities under various assumptions.

Methods & Contributions: This paper explores how bilinear pairings can significantly enhance group-based NIHC-VOLE schemes, presenting novel constructions under two distinct settings:
1. Public Setup: We propose a scheme achieving an online communication complexity of $O(\sqrt{n \log n})$ group elements, relying on a new BDDH-like assumption.
2. Designated Receiver Setup: Our construction drastically reduces the online communication to merely 3 group elements, with reusable offline communication of $O(n)$ group elements, based on the bilinear power DDH assumption.

Conclusion: By leveraging bilinear pairings, this work substantially minimizes the online communication overhead of NIHC-VOLE, providing highly efficient foundational tools for secure multi-party computation.

Abstract

Succinct Non-Interactive Half-Chosen VOLE allows a sender with a vector $\boldsymbol x$ of length $n$ and a receiver with a scalar $y$ to establish a pair of additive shares of $\boldsymbol x \cdot y$, by simultaneous exchange of succinct messages. Recent works construct NIHC-VOLE with $O(n^{2/3} \lambda)$ communication from various assumptions (Abram, Roy and Scholl, Eurocrypt 24) and poly-logarithmic communication from LWE (Abram, Malavolta and Roy, STOC 25).

We explore how bilinear pairings can improve group-based NIHC-VOLE schemes.
• In the public setup setting, our scheme has online communication of $O(\sqrt{n \log n})$ group elements. The scheme relies on a new BDDH-like assumption.
• In the designated receiver setting, our scheme has online communication of only 3 group elements and reusable offline communication of $O(n)$ group elements. The scheme relies on the bilinear power DDH assumption.

Homomorphic Functional Encryption: Trustless Key Derivation for Functional Encryption

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1921

AI Summary (中文)

研究背景：函数加密（FE）方案通常依赖于持有主密钥的受信任密钥管理者来派生功能解密密钥。这种集中式设计使密钥管理者成为信任的中心点和极易受攻击的目标，同时功能解密密钥的使用也可能引发信息泄露，导致严重的信任假设危机。

方法与创新：为缓解上述安全隐患，本文提出了一种结合同态加密（HE） 的无信任密钥派生机制，即“同态函数加密”。该方法允许FE的密钥派生算法在同态密文状态下进行评估。在先前关于函数盲密钥派生研究的基础上，本文将其创新性地扩展至三方部署模型。在该架构中，密钥管理者无需以明文形式接触或持有FE主密钥，即可完成安全的密钥派生。

主要发现与贡献：本文构建的方案在严格保留函数盲性的同时，有效保护了主密钥免受管理者窥探，从根本上降低了传统FE密钥管理中的信任假设。为验证该方案的工程适用性，本文开发了概念验证（PoC）原型系统，并运行了一系列基准测试以评估其实际性能。最后，秉持开放科学与可重复研究的理念，本文已将全部核心代码公开开源，为密码学社区提供了宝贵的实践参考。

AI Summary (English)

Functional encryption (FE) schemes traditionally rely on a trusted key curator holding the master secret key to derive functional decryption keys, creating a critical single point of failure and exacerbating trust assumptions regarding potential information leakage. To mitigate these vulnerabilities, this paper introduces Homomorphic Functional Encryption, which leverages homomorphic encryption (HE) to evaluate FE key-derivation algorithms over encrypted data in an innovative three-party deployment where the curator never accesses the master secret key in plaintext. Our resulting cryptographic construction rigorously preserves function blindness while effectively shielding the master secret key from the curator, thereby significantly minimizing the trust assumptions and security risks inherent in conventional FE key management systems. Furthermore, to validate the practical applicability and efficiency of our approach, we developed a proof-of-concept implementation, executed a comprehensive series of performance benchmarks, and publicly released our complete source code to foster open science and reproducible cryptographic research.

Abstract

In this paper, we study the trust assumptions underlying key generation in functional encryption (FE) schemes, as well as the information leakage that can arise from the use of functional decryption keys. FE schemes typically rely on a trusted key curator who holds the master secret key and derives functional decryption keys. This requirement makes the curator a central point of trust and a particularly sensitive target for compromise. We show how homomorphic encryption (HE) can be used to mitigate this problem by allowing FE key-derivation algorithms to be evaluated homomorphically. Building on prior work on function-blind key derivation [CHL20], we extend this approach to a three-party deployment in which the key curator does not hold the FE master secret key in the clear.
The resulting construction preserves function blindness while protecting the master secret key from the curator, thereby reducing the trust assumptions associated with conventional FE key management.
Additionally, to test the applicability of our approach, we made a proof-of-concept implementation and ran a series of benchmarks. Finally, as a way to support open science and reproducible research, we make our code publicly available.

Compact Lattice Anonymous Credentials from Tighter Approximate Range Proofs

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1920

AI Summary (中文)

研究背景

匿名凭证系统旨在实现加密真实性与强用户隐私保护的完美结合。近期，欧洲数字身份（EUDI）钱包倡议进一步凸显了对高效、私密且基于成熟安全基础的解决方案的迫切需求。这一趋势恰逢后量子密码学的过渡期，然而，当前基于标准假设的量子安全方案在性能上仍显著落后于基于特定交互假设的方案。

核心方法与优化

为弥补上述性能差距，本文提出了一系列创新技术，旨在显著提升基于标准格假设的匿名凭证系统的效率。研究团队深入分析了现有格隐私导向构造中的性能瓶颈，并针对性地进行了多维度的优化。

主要发现与创新点

本文的核心突破在于对 Lyubashevsky, Nguyen 和 Plançon (Crypto'22) 提出的零知识协议进行了关键性改进。具体而言，作者构造了更紧密的近似范围证明（tighter approximate range proofs）。这一改进直接攻克了当前格基匿名凭证构造中的主要效率瓶颈，使得基于标准假设的方案在紧凑性和效率上大幅跃升。该研究成功缩小了标准方案与特殊假设方案之间的差距，为后量子时代的隐私保护提供了更为坚实、紧凑且高效的标准化解决方案。

AI Summary (English)

Anonymous credentials systems are crucial for balancing cryptographic authenticity with strong user privacy, a need recently highlighted by the European Digital Identity (EUDI) wallet initiative during the ongoing post-quantum transition. However, current quantum-safe solutions based on standard assumptions still lag behind exotic interactive ones in overall performance. In this paper, we introduce several novel techniques to significantly enhance the efficiency of anonymous credentials built on standard lattice assumptions. Our primary breakthrough addresses the critical efficiency bottleneck in lattice-based privacy constructions by developing tighter approximate range proofs within the zero-knowledge protocol originally proposed by Lyubashevsky, Nguyen, and Plançon (Crypto'22). By optimizing these range proofs alongside other structural improvements, our approach successfully narrows the performance gap with more exotic schemes. These advancements ensure robust security without compromising the speed required for real-world applications, ultimately providing a highly efficient, compact, and well-founded post-quantum privacy solution.

Abstract

Accommodating cryptographic authenticity with strong user privacy assurances has been the primary motivation for anonymous credentials systems. Their features have recently come into the spotlight with the European Digital Identity (EUDI) wallet initiative, insisting on the need for efficient and private solutions based on well-understood security foundations for high assurances. This coincides with the post-quantum transition, but current quantum-safe solutions based on standard assumptions are still lagging behind the ones on ad-hoc interactive assumptions performance-wise.
In this paper, we present several techniques to improve the efficiency of anonymous credentials from standard lattice assumptions, narrowing the gap with more efficient but also more exotic ones. Alongside other optimizations, our main improvement stems from tighter approximate range proofs in the zero-knowledge protocol of Lyubashevsky, Nguyen, Plançon (Crypto'22), currently the efficiency bottleneck of lattice privacy-oriented constructions.

Cryptanalysis of Deep Neural Cryptography: Second Round Key Recovery on the Unprotected Implementation and a Floating-Point Attack on the Protected Implementation of AES

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1919

AI Summary (中文)

本文针对EUROCRYPT 2026提出的深度神经网络（DNN）密码实现进行了深入的密码分析。Gérault等人提出了一种自然DNN实现，通过ReLU网络在实数域上连续扩展块密码，并指出该扩展会暴露第一轮密钥，同时提出了一种可证明安全的黑盒变换。本文从攻击与防御两个维度重新审视了该成果。在攻击方面，针对未受保护的实现，本文改进了自然S盒的吸收特性，并结合选择明文碰撞测试，成功在约$2^{39}$次查询内恢复了AES-256的第二轮密钥，突破了以往仅能恢复第一轮密钥的限制。在防御方面，本文指出原有的安全变换仅在实数域上成立，而在神经网络实际运行的有限精度下存在严重漏洞。我们提出了一种浮点攻击，利用特定输入值在舍入时未能精确转换为比特的问题，仅通过128次选择查询便恢复了受保护AES-128实现的第一轮密钥。该漏洞在bfloat16至float64等多种浮点格式中均存在，提高精度无法修复。最后，本文提出在舍入前引入钳位（clamp）操作以阻断攻击，该修补既保持了密码功能与实数域安全性，又确保了有限输入在工作精度下处于$[0,1]$区间。整个构造在有限精度下的安全性证明仍是一个开放问题。

AI Summary (English)

This paper presents a cryptanalysis of the Deep Neural Cryptography implementations introduced at EUROCRYPT 2026. While the original work demonstrated that natural DNN extensions of block ciphers expose the first-round key and proposed a provably secure blackbox transformation over the reals, we revisit both the attack and defense aspects. On the attack side, by refining the absorption property of the natural S-box and employing a chosen-plaintext collision test, we recover the second-round key of the unprotected AES-256 in approximately $2^{39}$ queries. On the defense side, we expose a critical flaw in the proposed transformation under finite-precision arithmetic, the actual execution environment for neural networks. We introduce a floating-point attack that recovers the first-round key of the protected AES-128 in just 128 chosen queries by exploiting inputs that fail to round correctly to bits. This vulnerability persists across bfloat16, float16, float32, and float64 formats. Finally, we propose a simple clamp mechanism before the rounding step to mitigate this attack without compromising the cipher's functionality or its exact-real security guarantee.

Abstract

At EUROCRYPT 2026, Gérault et al. introduced natural DNN implementations of block ciphers: ReLU networks that agree exactly with the underlying cipher on binary inputs but extend it continuously to real-valued inputs. They showed that this extension exposes the first round key to recovery, and proposed a generic Secure Blackbox Transformation that turns an arbitrary DNN-based implementation into a provably secure implementation. We revisit both sides of their result. On the attack side, the known attacks on the unprotected implementation reach only the first round key. Under the same threat model, we refine the absorption property of the natural S-box and combine it with a chosen-plaintext collision test, validated empirically, to recover the second round key of AES-256 in about $2^{39}$ queries. On the defense side, their transformation is provably secure over the reals, but that guarantee does not carry over to finite precision, where any neural-network implementation must ultimately run. We give a floating-point attack that recovers the first round key of the protected AES-128 implementation in $128$ chosen queries, driven by an input value that the defense fails to round to a bit. Such a value exists in bfloat16, float16, float32, and float64, so moving to higher precision does not remove the weakness. We confirm the recovery in all four formats. Finally, we block the attack with a clamp placed before that rounding step, which keeps every finite input in $[0,1]$ in the working precision and changes neither the cipher nor the exact-real security guarantee. Whether a finite-precision security guarantee can be established for the construction as a whole remains open.

Towards Practical Privacy-Preserving SAT Solving

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1918

AI Summary (中文)

隐私保护布尔可满足性（SAT）求解器允许多个互不信任的参与方在不泄露各自输入的前提下，联合求解其私有公式的合取问题。然而，先前的代表性工作（如 ppSAT）由于仅支持最基础的 SAT 求解算法，在面对具有实际规模和复杂度的公式时往往无能为力。为了打破这一瓶颈，使隐私保护 SAT 求解真正迈向实用化，本文创新性地提出了一种名为 ppCDCL 的新型求解器。

在方法层面，ppCDCL 通过精心设计的不经意（oblivious）数据结构与全新的求解器架构，成功在隐私保护框架下实现了现代明文 SAT 求解器中最为核心的两大特性：冲突驱动子句学习（CDCL） 与高效传播机制。这不仅弥补了现有方案在算法层面的缺陷，更大幅提升了复杂公式的求解能力。

在主要发现与评估结果方面，实验数据充分证明了 ppCDCL 的优越性。与 ppSAT 相比，ppCDCL 在求解能力和执行效率上均实现了跨越式提升。在 Haplotype 基准测试中，其求解成功率由 65% 显著跃升至 98%；在规模更大、更具多样性的 SATLIB 基准测试中，成功率更是从 28% 大幅提高到 84%。此外，针对 SATLIB 实例，ppCDCL 能够在 1000 秒的时间限制内成功求解 36% 的样本，而原有的 ppSAT 仅能完成 4%。综上所述，ppCDCL 为大规模隐私保护 SAT 求解提供了切实可行的解决方案。

AI Summary (English)

Privacy-preserving Boolean satisfiability (SAT) solvers enable mutually distrustful parties to jointly solve their private formulas without leaking sensitive inputs. However, prior works such as ppSAT are severely limited to basic algorithms and consequently fail to handle formulas of practical size and complexity. To bridge this critical gap, we introduce ppCDCL, a novel solver that brings privacy-preserving SAT solving closer to practicality. By leveraging carefully orchestrated oblivious data structures and a redesigned solver architecture, ppCDCL successfully implements conflict-driven clause learning (CDCL) and efficient propagation, which are the two most crucial features of modern plaintext SAT solvers. Extensive evaluations demonstrate that ppCDCL significantly outperforms ppSAT in both capability and efficiency. Specifically, it solves 98% of Haplotype benchmarks (compared to 65% for ppSAT) and 84% of diverse SATLIB instances (compared to 28%). Furthermore, ppCDCL successfully solves 36% of SATLIB instances within 1,000 seconds, representing a remarkable improvement over the mere 4% achieved by the prior state-of-the-art.

Abstract

Privacy-preserving Boolean satisfiability (SAT) solvers allow multiple distrustful parties to solve the conjunction of their private formulas without revealing their inputs. Prior work on privacy-preserving SAT solvers, i.e., ppSAT (USENIX Security 2022), fails to solve formulas of practical size and complexity because it supports only the most basic SAT-solving algorithm. We bring privacy-preserving SAT solving closer to practicality by introducing ppCDCL. Through carefully orchestrated oblivious data structures and solver architecture, our new solver enables conflict-driven clause learning (CDCL) and efficient propagation, the two most important features of modern plaintext SAT solvers. Evaluation results show that ppCDCL outperforms ppSAT in both capability and efficiency. It solves significantly more instances: 98% vs. 65% on the Haplotype benchmarks and 84% vs. 28% on the larger, more diverse SATLIB benchmarks. Furthermore, it solves 36% of SATLIB instances within 1,000 seconds compared to only 4% for ppSAT.

Coral: General and Efficient Framework for Homomorphic Evaluation of Symmetric Ciphers

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1917

AI Summary (中文)

全同态加密（FHE）支持在密文上直接进行计算，但客户端加密成本高昂且产生的密文体积庞大。跨密码转换（Transciphering）技术通过允许客户端上传对称密文，并由服务端同态评估对称解密过程以获取FHE密文，从而有效缓解了上述问题。然而，Transciphering 本身易成为性能瓶颈，且目前仍缺乏一个能够高效支持结构多样化对称密码的通用框架。

为填补这一空白，本文提出了 Coral，一个基于 TFHE 构建的通用且高效的 Transciphering 框架。与将整个解密电路映射到单一评估策略的传统方法不同，Coral 在操作边界处对解密电路进行分解，并针对四种常见的计算模块提供了高度优化的处理流程：线性布尔运算、稀疏低次布尔函数、模加法以及小域替换。这些优化流程共享兼容的密文接口，使其能够在不同的密码算法中灵活重用与组合，从而在不牺牲通用性的前提下实现了极高的计算效率。

本文将 Coral 框架实例化于 Trivium、AES、ChaCha20 和 ZUC 等多种密码算法，涵盖了独立及组合的非线性结构。实验结果表明，与现有基线方法相比，Coral 在单线程执行下使 ZUC 的评估速度提升了高达 4.055 倍，在完全并行执行下使 ChaCha20 的速度提升了高达 5.517 倍。

AI Summary (English)

Fully homomorphic encryption (FHE) enables computation on encrypted data but incurs high client-side costs and large ciphertexts. Transciphering mitigates this by having clients upload symmetric ciphertexts while servers homomorphically evaluate symmetric decryption to obtain FHE ciphertexts. However, transciphering often becomes a performance bottleneck, and a general framework for efficiently supporting diverse symmetric ciphers remains lacking.

To address this, we present Coral, a general and efficient transciphering framework built on TFHE. Instead of mapping the entire decryption circuit to a uniform strategy, Coral decomposes it at operation boundaries and provides optimized procedures for four recurring computational modules: linear Boolean operations, sparse low-degree Boolean functions, modular additions, and small-domain substitutions. These procedures share compatible ciphertext interfaces, enabling reuse and composition across different ciphers to achieve high efficiency without sacrificing generality.

We instantiate Coral for Trivium, AES, ChaCha20, and ZUC, covering both individual and combined nonlinear structures. Compared to corresponding baselines, our implementations achieve speedups of up to 4.055× for ZUC under single-threaded execution and up to 5.517× for ChaCha20 under fully parallel execution.

Abstract

Fully homomorphic encryption (FHE) enables computation directly on encrypted data, but encrypting data under FHE imposes client-side computational costs and produces large ciphertexts. Transciphering addresses these costs by allowing the client to upload symmetric ciphertexts while the server homomorphically evaluates symmetric decryption to obtain FHE ciphertexts. However, transciphering itself can become a performance bottleneck, and a general framework for efficiently supporting structurally diverse symmetric ciphers is still lacking.

To fill this gap, we present Coral, a general and efficient transciphering framework built on TFHE. Rather than mapping an entire decryption circuit to a uniform evaluation strategy, Coral decomposes it at operation boundaries and provides optimized procedures for four recurring computational modules: linear Boolean operations, sparse low-degree Boolean functions, modular additions, and small-domain substitutions. These procedures share compatible ciphertext interfaces, allowing them to be reused and composed across different ciphers. Together, these optimized procedures enable Coral to achieve high efficiency without sacrificing generality.

We instantiate Coral for Trivium, AES, ChaCha20, and ZUC, covering both individual and combined nonlinear structures. Compared with the corresponding baselines, our implementations achieve speedups of up to $4.055\times$ for ZUC under single-threaded execution and up to $5.517\times$ for ChaCha20 under fully parallel execution.

Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

Tue, 08 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1916

AI Summary (中文)

本文以破解比特币等区块链技术使用的 $\mathtt{secp256k1}$ 曲线的256位椭圆曲线离散对数问题（ECDLP）为概念验证，充分展示了“行走猫架构”（Walking Cat Architecture）容错离子阱量子计算机在特定应用中的扩展与优化潜力。

在方法层面，研究深度优化了现有的逻辑量子电路，将其规模缩减至约1450个逻辑量子比特和4000万个Toffoli门。通过结合自研编译工具链、逻辑布局手动优化与集成路由技术，生成了严格遵循架构约束的测量调度方案。

本研究的核心创新点包括：
1. 开发快速CCZ魔法态工厂与深度为1的CCZ态注入技术，使CCZ门执行时间大幅缩短31倍；
2. 采用非重叠的“猫态”并行测量，显著提升逻辑测量的并行度；
3. 引入最新的逻辑CliNR协议以加速Clifford操作；
4. 提出更高效的损耗校正协议，设计了可循环复用CliNR辅助量子比特的物理布局，并根据电路峰值测量并行度合理配置猫态资源。

综合上述优化，研究得出结论：基于该架构的离子阱量子计算机仅需 19,397个物理量子比特，即可在约 25.7天 内成功解决 $\mathtt{secp256k1}$ 的ECDLP。其逻辑级成功概率的严格下界置信度至少为 $1-2^{-128}$，预估实际成功概率高达 63%。

AI Summary (English)

Using the Walking Cat Architecture for trapped-ion quantum computers, this study presents a comprehensive proof-of-concept optimization to solve the 256-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$ via Shor's algorithm. By optimizing logical circuits to just 1,450 qubits and 40 million Toffoli gates, implementing a fast CCZ magic-state factory that reduces CCZ execution time by a factor of 31, leveraging non-overlapping cat-based parallel measurements, and introducing the logical CliNR protocol alongside an efficient loss correction layout, we significantly minimize both gate execution times and overall physical qubit overhead. Ultimately, our compiled measurement schedules demonstrate that a fault-tolerant trapped-ion quantum computer based on this architecture can solve the $\mathtt{secp256k1}$ ECDLP in approximately 25.7 days using 19,397 physical qubits. This highly optimized approach achieves an estimated success probability of 63%, backed by a rigorous logical-level success lower bound with a confidence of at least $1-2^{-128}$.

Abstract

One of the strengths of our recently proposed Walking Cat Architecture for a trapped-ion quantum computer is that it is straightforward to extend and optimize for a specific application. As a proof-of-concept, here we present such optimizations for solving the $256$-bit elliptic curve discrete logarithm problem (ECDLP) on $\mathtt{secp256k1}$, which is the elliptic curve used by blockchain technologies such as Bitcoin, using Shor's algorithm. We optimize the circuits from Schrottenloher's recent work and arrive at a logical quantum circuit for solving the ECDLP using about $1450$ qubits and $40\cdot 10^6$ Toffoli gates, with a rigorous lower bound on the logical-level success probability that holds with confidence at least $1-2^{-128}$, as well as a heuristic estimate thereof. Using our compilation toolchain in combination with manual optimization of the logical layout and integrated routing, we produce estimates for the logical measurement depth and the required number of physical qubits by compiling all components to measurement schedules that obey the architectural constraints. A key ingredient is a fast CCZ magic-state factory and a depth-one CCZ state injection, reducing the execution time of CCZ gates by a factor of $31$. We increase the logical-measurement parallelism using non-overlapping cat-based measurements in parallel, and we leverage the recently proposed logical CliNR protocol to speed up Clifford operations. To reduce the qubit overhead, we introduce a more efficient loss correction protocol, design a layout that allows us to recycle the CliNR ancilla qubits, and provision reusable cat-state resources according to the circuit's peak measurement parallelism. All results and optimizations combined, we conclude that a trapped-ion quantum computer based on our architecture would be able to solve the ECDLP on $\mathtt{secp256k1}$ in approximately $25.7$ days using $19{,}397$ physical qubits with an estimated success probability of $63\%$.

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.08040

AI Summary (中文)

随着软件供应链对复杂且脆弱的依赖关系的日益加深，其已成为暴露度不断增加的攻击面。现有的防御工具（如 GitHub Dependabot）由于采用粗粒度匹配，无法准确判断脆弱依赖是否真正可被利用，从而导致大量误报。安全分析师通常需要耗费大量时间逐一评估漏洞的可利用性。尽管近期的大语言模型（LLM）智能体在编程和网络安全方面展现出卓越能力，但目前尚无专门针对此任务的评估基准。以往的基准测试主要聚焦于零日（0-day）漏洞场景，而软件供应链安全则侧重于评估上游依赖中的已知漏洞如何影响下游项目，这要求智能体具备跨仓库推理的能力。

为填补这一空白，本文提出了 VEX-Bench，这是首个用于评估 LLM 智能体判断软件供应链漏洞可利用性能力的基准测试。该基准包含 75 个从 GitHub 挖掘并由安全专家标注的真实案例，全面覆盖 Python、Java 和 Go 三种主流编程语言。我们在三种智能体框架下对 9 个模型进行了广泛评估。实验结果表明，虽然 GPT-5.5 和 Claude Opus 4.6 在二分类漏洞状态判定上达到了约 80% 的 F1 分数，但仅有 GPT-5.5 在细粒度可利用性理由分类中的 macro-F1 超过了 70%。这一显著差距深刻揭示了当前模型在突破二分类评估、精准识别细粒度可利用性原因方面所面临的严峻挑战。

AI Summary (English)

The software supply chain is a critical attack surface, yet existing tools suffer from high false-positive rates due to coarse-grained matching, making vulnerability exploitability assessment highly time-consuming. While Large Language Model (LLM) agents show promise in cybersecurity, current benchmarks focus on zero-day exploits rather than the cross-repository reasoning required to assess known upstream vulnerabilities in downstream projects. To bridge this gap, we introduce VEX-Bench, the first benchmark designed to evaluate LLM agents' capabilities in assessing software supply chain vulnerability exploitability, comprising 75 expert-labeled, real-world GitHub cases across Python, Java, and Go. Evaluating nine models across three agent harnesses, we found that while top models like GPT-5.5 and Claude Opus 4.6 achieve approximately 80% F1 in binary classification, only GPT-5.5 surpasses 70% macro-F1 in fine-grained justification classification. This performance gap highlights the significant challenge for LLM agents in advancing from binary exploitability assessment to identifying fine-grained, actionable exploitation reasons.

Abstract

The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependency is actually exploitable. Security analysts typically spend substantial time assessing vulnerability exploitability case by case. Recent LLM agents have emerged as promising candidates for this task given their advanced capabilities in coding and cybersecurity, yet no existing benchmark evaluates them on it. Prior benchmarks target zero-day settings, where agents detect and exploit previously unknown vulnerabilities. In contrast, software supply chain security focuses on how known vulnerabilities in upstream dependencies affect downstream projects. This requires agents to reason across repositories and determine whether an upstream vulnerability is exploitable in the downstream project. To address this gap, we introduce VEX-Bench, the first benchmark for evaluating LLM agents' ability to assess the exploitability of software supply chain vulnerabilities. It contains 75 real-world cases mined from GitHub and labeled by security experts, covering Python, Java, and Go. We evaluate nine models across three agent harnesses. While GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. This gap highlights the challenge of moving beyond binary exploitability assessment to identifying fine-grained exploitability reasons. Code and data: https://github.com/steven1518/vex-bench

ZK-eSIM: A Privacy-Centric Zero-Knowledge Approach for eSIM Provisioning

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07654

AI Summary (中文)

GSMA远程SIM配置（RSP）实现了eSIM配置文件的空中交付，但在订购和下载过程中会暴露长期标识符（如EID、配置文件标识符和长期证书材料）。这使得移动运营商和基础设施能够将配置事件链接至同一eUICC，甚至结合账户记录追踪至具体用户，严重破坏了用户匿名性并导致跨会话追踪。

本文提出 ZK-eSIM，一种以隐私为中心的零知识方法，旨在实现用户匿名性和配置会话的不可链接性，同时保留基于例外的可问责追踪。其核心创新包括：
1. 零知识设备证明：使用设备有效性和资格的零知识证明，替代设备标识符的直接披露。
2. 会话不可链接性：通过短期、一次性伪名凭证和每会话标识符，防止跨会话追踪。
3. 可问责追踪：引入联合授权的托管机制，提供保护隐私的追踪能力，确保单一实体无法单方面对用户去匿名化。

研究形式化了多实体“诚实但好奇”的威胁模型，并在标准密码学假设下严格证明了匿名性和不可链接性。我们在测试eUICC上实现了Java Card小程序，结合修改后的LPA和SM-DP+服务器评估了系统性能。实验表明，与传统RSP相比，ZK-eSIM仅增加了极小的端到端密码学开销。ZK-eSIM在填补关键隐私空白的同时，完全兼容并保留了现有GSMA角色和接口的可部署性。

AI Summary (English)

GSMA Remote SIM Provisioning (RSP) exposes long-lived identifiers during eSIM profile delivery, enabling cross-session tracking and undermining subscriber anonymity. To address this, we propose ZK-eSIM, a privacy-preserving redesign that ensures subscriber anonymity and session unlinkability while retaining accountable traceability by exception. ZK-eSIM introduces three key mechanisms: (i) replacing direct device identifier disclosure with zero-knowledge proofs of device validity; (ii) enforcing session unlinkability via short-lived, one-time pseudonymous credentials; and (iii) enabling privacy-preserving traceability through a jointly authorized escrow mechanism, preventing unilateral deanonymization. We formalize a multi-entity honest-but-curious threat model and formally prove anonymity and unlinkability under standard cryptographic assumptions. Furthermore, we implement a Java Card applet on a test eUICC and evaluate performance using a modified LPA and SM-DP+ server. Our experiments demonstrate that ZK-eSIM introduces only minimal practical cryptographic overhead compared to conventional RSP, successfully bridging a critical privacy gap while maintaining full deployability within existing GSMA architectures.

Abstract

GSMA Remote SIM Provisioning (RSP) enables over-the-air delivery of eSIM profiles, but it exposes long-lived identifiers during profile ordering and download. In particular, stable device identifiers (e.g., EID), profile identifiers, and long-lived certificate material enable mobile operators and profile-delivery infrastructure to link provisioning events to the same eUICC and, when combined with account records, to the same subscriber. This undermines subscriber anonymity and enables cross-session tracking. We present ZK-eSIM, a privacy-preserving redesign that achieves subscriber anonymity and provisioning-session unlinkability while retaining accountable traceability by exception. ZK-eSIM (i) replaces direct disclosure of device identifiers with a zero-knowledge proof of device validity and eligibility; (ii) enforces session unlinkability through short-lived, one-time pseudonymous credentials and per-session identifiers to prevent cross-session tracking; and (iii) provides privacy-preserving accountable traceability through a jointly authorised escrow mechanism, so that no single entity can unilaterally deanonymise a user. We formalise a multi-entity, honest-but-curious threat model and prove subscriber anonymity and the unlinkability of provisioning sessions under standard cryptographic assumptions. We implement a Java Card applet on a test eUICC to evaluate performance on commodity hardware with a modified LPA and SM-DP+ server. Our experiments quantify end-to-end cryptographic overhead relative to conventional RSP, confirming that ZK-eSIM adds only practical overhead, closing a critical privacy gap while preserving deployability within existing GSMA roles and interfaces.

Staying on the Attack Path: Structured State for Long-Horizon Automated Penetration Testing

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07344

AI Summary (中文)

基于大语言模型（LLM）的智能体在自动化渗透测试等长期网络安全任务中面临上下文遗忘与意图漂移的严峻挑战，导致早期关键事实丢失并陷入无目的的重复探索。为解决这一问题，本文提出 Intentest，一种基于意图图引导的自动化渗透测试智能体。该框架创新性地将长期状态从 LLM 的上下文窗口外化至持久的事实-意图有向无环图（DAG）中，从而大幅减少无效的状态转移。系统采用先进的三层架构：事实-意图映射层维护全局状态，将验证的网络状态作为不可变事实节点，探索方向受前驱事实约束的意图边限制；任务调度与分配层通过两阶段降级恢复与多维自适应负载均衡机制保障执行的稳定性；意图检索与预测层则利用自顶向下的五阶段过滤算法提供战术先验。在涵盖十余种漏洞类型及三个难度级别的真实 CTF 基准测试中，Intentest 的整体成功率高达 88.2%，困难任务成功率达 75.0%，较基线模型分别大幅提升约 44 和 50 个百分点。此外，消融实验表明，意图检索与预测模块在不改变可解任务集的前提下，使中等和困难任务的平均成功轮数分别减少约 33% 和 48%，显著提升了攻击路径的探索效率。

AI Summary (English)

Large language model (LLM) agents applied to automated penetration testing often suffer from context forgetting and intent drift during long-horizon tasks, which leads to the loss of critical causal reasoning and aimless, repetitive exploration. To address these limitations, we propose Intentest, an intent-graph-guided agent that externalizes long-horizon states from the LLM's context window into a persistent fact-intent directed acyclic graph (DAG). The system employs a robust three-layer architecture, including fact-intent mapping for global state maintenance, task scheduling for execution stability, and intent retrieval for providing tactical priors. Evaluated on a comprehensive benchmark of real CTF challenges spanning multiple difficulty levels and vulnerability types, Intentest achieves an overall success rate of 88.2% and 75.0% on hard tasks, outperforming the baseline by approximately 44 and 50 percentage points, respectively. Furthermore, ablation studies demonstrate that the intent retrieval and prediction mechanisms significantly enhance efficiency, reducing the average interaction rounds for successful medium and hard tasks by 33% and 48% without altering the set of solvable tasks.

Abstract

Large language model (LLM) based agents are increasingly applied to cybersecurity tasks such as vulnerability discovery and automated penetration testing. On long-horizon security tasks, however, such agents remain limited by context forgetting and intent drift: early critical facts and causal reasoning chains are lost over extended interactions, and the agent falls into aimless, repetitive exploration. This paper proposes Intentest, an intent-graph-guided automated penetration testing agent that externalizes long-horizon state from the LLM's context window onto a persistent fact-intent directed acyclic graph (DAG), thereby substantially reducing invalid transitions. We evaluate Intentest on automated penetration testing of web applications, a representative long-tail task in cybersecurity. In the DAG, verified network states are stored as immutable fact nodes, and exploration directions are constrained as intent edges bounded by predecessor facts. The system adopts a three-layer architecture, in which the fact-intent mapping layer maintains the global state, the task scheduling and allocation layer ensures execution stability through two-phase degradation recovery and multi-dimensional adaptive load balancing, and the intent retrieval and prediction layer provides tactical priors through a top-down five-stage filtering algorithm. On a benchmark of real CTF challenges covering more than ten vulnerability types across three difficulty levels, Intentest achieves an overall success rate of 88.2% and a success rate of 75.0% on hard tasks, improving over the baseline by approximately 44 and 50 percentage points. Ablation experiments further show that the intent retrieval and prediction reduce the average number of rounds on successful medium and hard tasks by about 33% and 48%, respectively, without changing the set of solvable tasks.

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07244

AI Summary (中文)

研究背景与问题
在工业控制系统（ICS）和运营技术（OT）环境中，基于异常的入侵检测系统日益需要满足形式化的弹性标准，包括吸收对抗性干扰、在持续攻击下优雅降级以及提供系统级认证保证。然而，现有的网络物理系统弹性框架仅在架构层面定义弹性轨迹，未将机器学习异常检测器视为核心组件，导致组件级鲁棒性评估与系统级弹性认证之间存在显著脱节。

理论方法与创新
本文确立了ICS异常检测中的对抗鲁棒性本质上是系统弹性的一种具体实例化，并通过将干扰类别、吸收能力、恢复轨迹和降级函数这四个弹性构造映射到对抗机器学习场景，对这一联系进行了形式化。此外，本文推导了异构ICS检测网络的组合弹性边界，揭示了系统级弹性的关键约束在于攻击路径上各节点“经耦合调整后的吸收能力”，而非单一节点的绝对能力。这意味着系统的瓶颈节点未必是传统意义上最弱的节点。

实验验证与发现
在BATADAL水处理系统基准数据集上的实证验证表明，所提出的指标能够揭示标准评估基准无法捕捉的关键运维现象。具体发现包括：对抗训练中出现的“吸收-降级发散”现象，以及一个反直觉的悖论——孤立地加固瓶颈节点反而会降低整体系统级弹性。本文最后探讨了对ICS架构设计与认证标准的深远影响。

AI Summary (English)

While anomaly-based intrusion detection systems in industrial control systems (ICS) require formal resilience guarantees, existing frameworks fail to treat machine learning detectors as first-class components, creating a critical gap between component-level robustness and system-level resilience. This paper establishes adversarial robustness in ICS anomaly detection as a specific instantiation of system resilience, formalizing this connection by mapping four resilience constructs—disturbance class, absorption capacity, recovery trajectory, and degradation function—onto the adversarial machine learning setting. We derive a compositional resilience bound for heterogeneous ICS networks, demonstrating that the binding constraint on system-level resilience is the coupling-adjusted absorption capacity along the attack path, rather than the per-node capacity. Empirical validation on the BATADAL water distribution benchmark reveals operationally significant phenomena invisible to standard evaluation metrics, notably the absorption-degradation divergence under adversarial training and the counterintuitive paradox where hardening the binding node in isolation actually reduces overall system resilience, thereby providing critical implications for future ICS architecture design and certification standards.

Abstract

Anomaly-based intrusion detection systems in industrial control systems (ICS) and operational technology (OT) environments are increasingly required to meet formal resilience criteria: absorbed adversarial disturbances, graceful degradation under sustained attack, and certified system-level guarantees. Existing resilience frameworks for cyber-physical systems define absorb-recover-adapt trajectories at the architectural level but do not treat machine learning anomaly detectors as first-class components, leaving a gap between component-level robustness evaluation and system-level resilience certification. In this paper, we establish that adversarial robustness in ICS anomaly detection is a specific instantiation of system resilience, and formalise this connection by mapping four resilience constructs, i.e. disturbance class, absorption capacity, recovery trajectory, and degradation function, onto the adversarial machine learning setting. We derive a compositional resilience bound for heterogeneous ICS detection networks, showing that the binding constraint on system-level resilience is the coupling-adjusted absorption capacity of each node along the attack path, not the per-node capacity -- so the binding node need not be the weakest one. Empirical validation on the BATADAL water distribution system benchmark demonstrates that the resulting metrics surface operationally significant phenomena invisible to standard benchmarks: the absorption-degradation divergence under adversarial training, and the paradox that hardening the binding node in isolation reduces system-level resilience. Implications for ICS architecture design and certification standards are discussed.

AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07131

AI Summary (中文)

背景：大语言模型（LLM）智能体通过结合基础模型、显式技能与隐式程序知识，正逐步实现复杂的长期任务，这些任务解决能力已成为极具价值的专有资产。

问题：现有的“技能窃取”攻击仅能恢复显式技能工件。然而，工件泄漏并不等同于能力转移：较弱的攻击者智能体即使拥有相同的技能，仍会因缺乏强智能体隐式实现的程序行为而导致任务失败。

创新与方法：本文提出关键洞察——“技能执行差距”本身构成了新的泄漏面，缺失的行为可通过对比受害者成功执行与攻击者失败执行的可观察差异来暴露。基于此，我们提出 AgentLeak，一种黑盒能力克隆攻击。该方法从执行差异中识别出对能力至关重要的行为，并将其整合到攻击者技能中，且无需更改攻击者的底层模型、框架和工具。

结果与发现：在涵盖600个实例的20个任务场景及多种智能体系统中，AgentLeak 将任务通过率提升了 40%以上，并弥补了超过 80% 的能力差距。研究表明，仅保护显式工件是远远不够的，可观察的执行行为同样会泄漏重构专有任务解决能力所需的程序知识，揭示了LLM智能体面临的全新机密性风险。

AI Summary (English)

Background & Problem: As Large Language Model (LLM) agents increasingly solve complex long-horizon tasks, their combined explicit skills and implicit procedural knowledge have become valuable proprietary assets. However, existing skill-stealing attacks only recover explicit artifacts. This artifact leakage does not necessarily transfer capability, as weaker attacker-controlled agents still fail due to lacking the implicit procedural behaviors realized by stronger proprietary agents.

Method: We reveal that the "skill execution gap" itself forms a novel leakage surface. We propose AgentLeak, a black-box capability-cloning attack that extracts capability-critical behaviors from the observable differences between successful victim executions and failed attacker executions. It seamlessly integrates these missing behaviors into the attacker's skills while keeping the attacker's model, harness, and tools completely unchanged.

Results: Evaluated across 600 instances in 20 diverse task scenarios with multiple backbone models, AgentLeak significantly improves task pass rates by over 40% compared to direct skill reuse and successfully recovers more than 80% of the victim-attacker capability gap.

Conclusion: Our findings highlight a critical confidentiality risk in LLM agents: protecting explicit artifacts alone is insufficient, as observable execution behaviors can easily leak the procedural knowledge required to reconstruct proprietary task-solving capabilities.

Abstract

Large language model (LLM) agents increasingly achieve long-horizon tasks by combining foundation models with explicit skills and implicit procedural knowledge acquired through execution. The resulting task-solving capabilities have become valuable proprietary assets, raising a new security question: can a substantially weaker attacker-controlled agent acquire the capabilities of a stronger proprietary agent through limited black-box interaction? Existing skill-stealing attacks recover explicit skill artifacts, yet we show that artifact leakage does not necessarily transfer capability: a weaker agent may possess the same skills but still fail because it lacks procedural behaviors implicitly realized by the stronger agent. Our key insight is that the skill execution gap itself forms a leakage surface, where missing behaviors are exposed through observable differences between successful victim executions and failed attacker executions. Based on this, we present AgentLeak, a black-box capability-cloning attack that identifies capability-critical behaviors from these execution differences and incorporates them into attacker-side skills, while keeping the attacker's model, harness, and tools unchanged. Across 20 task scenarios comprising 600 instances, diverse agent systems, and multiple backbone models, AgentLeak improves task pass rates by over 40% compared with direct skill reuse and recovers more than 80% of the victim--attacker capability gap. Our findings reveal a confidentiality risk in LLM agents: protecting explicit artifacts alone is insufficient, as observable execution behavior can leak the procedural knowledge required to reconstruct proprietary task-solving capabilities in low-capability and attacker-controlled agents.

AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06972

AI Summary (中文)

背景：大型语言模型（LLM）智能体通过发出工具调用序列来完成任务，其读取的每次观察都可能成为间接提示注入的通道。成功的注入在轨迹中表现为从良性前缀转变为服务于攻击者的行为。现有基准仅评估攻击是否成功或整体判断轨迹，缺乏逐步标注注入点及受污染步骤的公开语料库。

方法：本文提出 AgentDrift，一个包含 12,536 个合成工具调用轨迹的基准测试，涵盖 5 个智能体领域。其 71,024 个步骤均被标记为四类之一：良性、注入点、被劫持或注入失败。语料库包含 4,000 条良性、5,536 条受攻击、1,500 条攻击失败及 1,500 条困难负样本轨迹。轨迹由单一开源模型在特定协议下生成，经封闭词汇结构验证器筛选、LLM 评判者审查，并对 1,200 条轨迹进行人工审计。

发现与创新：研究发现 LLM 评判者会被困难负样本欺骗。基于表面特征的逻辑回归仅能识别 55.4% 的攻击（F1 为 0.647），对部分劫持和延迟执行的召回率极低，表明近半数攻击需对行为序列进行建模。此外，本文测量了生成数据中的模板集中度、攻击目标族崩溃及世界身份泄漏现象。该语料库及文档已在 CC BY 4.0 协议下开源。

AI Summary (English)

Background & Method: Existing benchmarks evaluate whether injection attacks succeed against live agents or judge traces as a whole, but lack step-level labels indicating where injections enter and which steps they corrupt. To address this, we introduce AgentDrift, a comprehensive benchmark of 12,536 synthetic tool-call trajectories across five domains, comprising 71,024 steps meticulously labeled as benign, injection point, hijacked, or failed injection. The corpus features benign, attacked, failed-attack, and hard-negative trajectories, generated via strict category-specific protocols and rigorously validated by structural checks, LLM judges, and human audits.

Findings & Contributions: Our experiments reveal that surface-feature logistic regression recovers only 55.4% of attacks, highlighting the critical necessity of behavioral sequence modeling to detect complex partial hijacks and delayed executions. Furthermore, we identify template concentration, attack-goal-family collapse, and world-identity leakage within the generated data. AgentDrift, along with its comprehensive documentation, is publicly released under the CC BY 4.0 license to advance robust agent security research.

Abstract

LLM agents complete tasks by issuing sequences of tool calls, and every observation they read is a channel through which an indirect prompt injection can enter. A successful injection has a characteristic shape when the trajectory is read in order: a benign prefix gives way to actions that serve the attacker rather than the user. Existing benchmarks measure whether such attacks succeed against live agents, and existing guard models judge a trace as a whole; no public corpus labels, step by step, where an injection enters a trajectory and which steps it corrupts. We present AgentDrift, a benchmark of 12,536 synthetic tool-call trajectories over five agent domains in which every one of the 71,024 steps carries one of four labels: benign, injection point, hijacked, or failed injection. The corpus contains 4,000 benign, 5,536 attacked, 1,500 failed-attack, and 1,500 hard-negative trajectories; attacked trajectories follow three compliance patterns whose label strings obey a stated regular grammar. Failed attacks carry an injection the agent resisted, and hard negatives carry legitimate content that resembles an attack, so a detector must separate attempt from success and deviation from novelty. Trajectories were generated by a single open model under category-specific protocols, enforced by a closed-vocabulary structural validator, screened by an LLM judge, and audited by hand on 1,200 trajectories; we show that the LLM judge was itself fooled by the hard negatives. A surface-feature logistic regression recovers only 55.4% of attacks (F1 0.647), including only 8.2% of partial hijacks and 23.1% of delayed executions, so nearly half of the attacks require modeling the behavioral sequence. We measure template concentration, attack-goal-family collapse, and world-identity leakage in the generated data, and release the corpus with its documentation under CC BY 4.0.

A Tool-Augmented, GPT-4 Chatbot for Real-Time Repository Data Analysis

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07586

AI Summary (中文)

研究背景：软件仓库中蕴含着海量的代码贡献、缺陷报告及项目活动数据。然而，由于缺乏专业的数据库查询技能，非技术利益相关者及部分开发者难以高效获取并利用这些宝贵的信息资源。

方法与创新点：为打破这一数据访问壁垒，本文提出了一种新颖的聊天机器人架构，利用 OpenAI 的 GPT-4 模型实现仓库数据的自动化提取与深度分析。该架构采用创新的结构化处理路径：首先精准解析用户查询以提取关键参数，随后根据分析结果智能选择最匹配的执行工具，最后交由 GPT-4 生成详尽且结构化的回复。与以往依赖嵌入模型和文档检索器的复杂多组件系统不同，本研究反转了传统处理流程，核心依赖于提示工程（Prompt Engineering）与动态工具选择来完美契合查询意图。

实验设计与主要发现：我们在多种问题类型（涵盖 Issues、Pull Requests、Commits、复合问题及常规仓库信息）上开展了广泛实验，重点评估了目标提示词在提升模型响应准确性方面的实际效能。实验结果表明，该架构能显著降低模型幻觉并提高数据提取的精确度。

研究结论：研究结果不仅验证了该架构在多样化用户场景下的卓越实用性，更表明其能够通过输出可操作的深度见解，使复杂的仓库数据对技术和非技术受众均变得触手可及。

AI Summary (English)

Background: Software repositories contain vast amounts of data, yet accessing this information remains challenging for non-technical stakeholders due to limited querying expertise.

Method & Innovation: To address this, we introduce a novel GPT-4-powered chatbot architecture that automates repository data extraction and analysis. Unlike previous multi-component systems relying on embedding models and document retrievers, our approach inverts the traditional process. It follows a structured path: parsing user queries to extract parameters, selecting the appropriate tools based on this analysis, and finally invoking GPT-4 to generate highly detailed responses through targeted prompt engineering and tool selection.

Experiments & Results: We validated our approach through extensive experiments across various question types, including Issues, Pull Requests, Commits, and compound questions. The results demonstrate that our specifically designed prompts significantly improve the accuracy and relevance of the model's responses.

Conclusion: Ultimately, this architecture successfully produces actionable insights, making complex repository data highly accessible and valuable for both technical and non-technical audiences.

Abstract

Software repositories contain vast amounts of data on code contributions, bug reports, and project activities, yet this information remains challenging for non-technical stakeholders and developers to access due to limited expertise in querying repositories. To address this, we introduce a novel chatbot architecture leveraging OpenAI's GPT-4 model for automated extraction and analysis of repository data. In contrast, our architecture takes a structured path first by parsing the user's query to extract relevant parameters, then selecting the correct tool to employ based on that analysis, and finally invoking the GPT-4 model to create a highly detailed response. In contrast to previous work based on multi-component systems with embedding models and document retrievers, our architecture inverts the process by relying on prompt engineering and tool selection to fit with the query intent. To validate our approach, we conducted experiments on various question types, including Issues, Pull Requests, Commits, Compound Questions, and General Repository Information, evaluating our target prompts' ability to improve the accuracy of responses from the model. Beyond demonstrating the utility of this architecture to a diverse set of users, our findings suggest that this architecture can make repository data more accessible to technical and non-technical audiences through the production of actionable insights.

Quantile-Led Feature Extraction for Multi-Horizon Predictive Maintenance in Industrial Manufacturing Systems

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07533

AI Summary (中文)

在数据驱动的预测性维护（PdM）中，特征提取通常被视为固定的预处理步骤，即选定描述符集后便重复使用，忽略了下游预测时间范围（horizon）的变化。本文分离了表示学习阶段，提出了一种基于双阶段MLP-QRNN层次结构的分位数引导特征提取框架。第一阶段（QRNN1）为每个传感器通道学习广泛的十分位数条件分布；第二阶段（QRNN2）通过跳跃连接，将保留的中间尾部分位数精炼为紧凑的、通道分辨的分布感知特征。在9个工业设施的72台机器上进行的跨1小时、70小时和30天预测期的实验表明：将保留的中间尾部分位数从2个增至4个，可显著提升短期F1分数（启用注意力机制时达75.92%）。此外，研究证实特征表示无法可靠迁移至设计范围之外，除非特征容量和时间嵌入等随预测任务进行扩展。未修改的短视距提取器在70小时预测中F1降至42.90%，而视距条件提取器在70小时和30天分别达到60.38%和79.97%。该框架支持将PdM特征提取从固定预处理重新定义为依赖于预测时间范围的动态表示学习阶段。

AI Summary (English)

In data-driven predictive maintenance (PdM), feature extraction is traditionally treated as a fixed preprocessing step, ignoring the critical variations in downstream forecasting horizons. To address this limitation, we propose a novel quantile-led feature extraction framework utilizing a dual-stage MLP-QRNN hierarchy, where the first stage learns a broad ten-quantile distribution and the second refines mid-tail quantiles into compact, distribution-aware features. Extensive experiments across 72 machines in 9 industrial facilities demonstrate that increasing retained mid-tail quantiles significantly improves short-term F1-scores, while horizon-conditioned extractors vastly outperform unmodified ones in long-term predictions (achieving 79.97% F1 at 30 days versus 42.90%). Ultimately, our findings reveal that feature representations fail to transfer reliably across different horizons unless scaled appropriately, supporting the paradigm shift of treating PdM feature extraction as a dynamic, horizon-dependent representational stage rather than static preprocessing.

Abstract

In data-driven predictive maintenance (PdM), feature extraction is usually treated as fixed preprocessing: a descriptor set is chosen once and reused while the downstream model or forecasting horizon changes. This paper isolates the representation-learning stage and presents a quantile-led feature-extraction framework based on a dual-stage MLP-QRNN hierarchy. QRNN1 learns a broad ten-quantile conditional distribution for each sensor channel, while skip-connected QRNN2 refines a retained mid-tail quantile set into compact, channel-resolved, distribution-aware features. A fixed thirteen-pipeline ablation spans 1-hour, 70-hour, and 30-day regimes across 72 machines in 9 industrial facilities, with the downstream temporal classifier held fixed within each regime. Increasing the retained mid-tail set from two to four quantiles improves 30- and 60-minute F1-score, reaching 75.92% and 72.44% with attention enabled. The results also show that representations do not transfer reliably beyond their design horizon unless feature capacity, temporal embedding, activation strategy, and sensor breadth are scaled with the forecasting task. The unmodified short-horizon extractor falls to 42.90% F1 at 70 hours, whereas horizon-conditioned extractors reach 60.38% at 70 hours and 79.97% at 30 days. The framework therefore supports treating PdM feature extraction as a horizon-dependent representational stage rather than fixed preprocessing.

AAS-RAIL: Improving Information Extraction for Asset Administration Shells through Retrieval-Augmented In-Context Learning

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07334

AI Summary (中文)

背景：资产管理壳（AAS）是工业4.0和数字产品护照的基石，为工业资产提供标准化的数字表示。然而，从现有的产品数据表中生成AAS实例是一项劳动密集型任务，因为技术信息散布在异构的文档结构中，且通常涉及公司特定的术语与排版惯例。

方法与创新：本文提出了AAS-RAIL，一种检索增强的信息提取方法，利用大语言模型（LLM）从PDF数据表中自动生成AAS。与依赖固定少样本示例的传统方法不同，该研究的核心创新在于检索增强上下文学习（RAIL）。它为每个数据表动态检索并选择相似AAS中由LLM生成的提取辅助信息，提供特定于实例的上下文学习（ICL）。这种结合了语义检索与结构化信息提取的动态管道，取代了静态提示，使模型无需微调即可精准适应公司特定的命名约定和格式风格。

主要发现：在包含多种开源和闭源LLM的工业产品数据表集合上进行的评估表明，RAIL在提取质量上始终优于传统的少样本提示方法，取得了30.4%至52.4%的相对提升。实验结果充分证明，该动态选择机制为公司特定AAS的自动化生成提供了一种高效且极具价值的改进方案。

AI Summary (English)

Generating Asset Administration Shell (AAS) instances from heterogeneous product datasheets remains a labor-intensive task due to complex document structures and company-specific terminologies. To address this challenge, we propose AAS-RAIL, a novel retrieval-augmented in-context learning approach that automatically generates AAS from PDF datasheets using large language models (LLMs). Unlike traditional methods relying on static few-shot examples, our core innovation lies in dynamically retrieving LLM-generated extraction helpers from similar AAS instances. This provides instance-specific context that adapts to unique naming conventions and formatting styles without the need for model fine-tuning. Evaluated on a diverse collection of industrial product datasheets using various open- and closed-weight LLMs, experimental results demonstrate that AAS-RAIL consistently outperforms conventional few-shot prompting. Specifically, the proposed method yields significant relative improvements in extraction quality, ranging from 30.4% to 52.4%. Ultimately, these findings confirm that replacing static prompting with a dynamic, semantically-driven extraction pipeline offers a highly effective and scalable solution for automated, company-specific AAS generation in Industry 4.0 and the Digital Product Passport ecosystem.

Abstract

The Asset Administration Shell (AAS) is a cornerstone of Industry 4.0 and the Digital Product Passport, providing standardized digital representations of industrial assets. While manufacturers already maintain extensive technical product documentation, generating AAS instances from existing product datasheets remains a labor-intensive task because technical information is extracted from heterogeneous document structures and often involves company-specific terminology and conventions. In this work, we present AAS-RAIL, a retrieval-augmented information extraction (IE) approach that automatically generates Asset Administration Shells from PDF product datasheets using large language models (LLMs). Instead of relying on a fixed set of few-shot examples, the proposed retrieval-augmented in-context learning (RAIL) approach retrieves LLM-generated extraction helpers from similar Asset Administration Shells to provide instance-specific in-context learning (ICL). This enables the model to adapt its extraction behavior to company-specific naming conventions and formatting styles without fine-tuning. Our core contribution is the dynamic selection of company-specific AAS examples for each datasheet, replacing static prompting with an extraction pipeline that adapts to instances and combines semantic retrieval and structured information extraction. The proposed approach is evaluated on a collection of industrial product datasheets using a selection of open- and closed-weight LLMs. Experimental results show that RAIL consistently improves extraction quality over conventional few-shot prompting, yielding relative improvements of 30.4-52.4%. These results demonstrate that our approach provides an effective improvement for company-specific AAS generation.

CoRL: Co-Evolutionary Reinforcement Learning for Adaptive Indirect Prompt-Injection Attacks and Defenses

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07529

AI Summary (中文)

背景：工具增强的语言代理极易受到间接提示注入（IPI）攻击。与直接注入不同，IPI将恶意指令隐藏于不可信的工具输出中，暗中篡改合法任务的执行。由于攻击者会动态调整策略、注入位置与载荷，基于固定攻击训练的防御方法往往难以奏效。

方法：本文将自适应IPI建模为非对称、部分可观察的一般和马尔可夫博弈，并提出CoRL（协同进化强化学习）框架。该框架包含三个核心阶段：
1. Attacker SFT：利用成功轨迹初始化多轮攻击；
2. Bilateral Co-PPO：通过角色特定奖励与历史对手种群联合训练攻防双方；
3. Defender SFT：整合验证器接受的教师修复策略，以应对种群挖掘出的防御漏洞。

发现与创新：在1514次测试执行中，CoRL将整体攻击成功率（ASR）大幅降低38.5个百分点至0.0%，同时将任务效用提升13.1个百分点至76.3%。消融实验证实了在线Co-PPO与种群挖掘修复的积极作用，外部基准评估表明其具备攻击抵抗力的迁移能力。该框架使防御者能在复杂攻击下完美平衡安全性与任务效用，同时保留的攻击者模型可为自适应红队评估提供高质量候选。

AI Summary (English)

Background & Method: Tool-augmented language agents are vulnerable to indirect prompt injection (IPI), where adversarial instructions hidden in tool outputs covertly alter task execution. To address the failure of static defenses against adaptive attacks, we formulate adaptive IPI as an asymmetric Markov game and propose CoRL, a verifier-grounded co-evolutionary reinforcement learning framework. CoRL integrates three stages: Attacker SFT for initializing multi-turn attacks, Bilateral Co-PPO for joint training with role-specific rewards and historical populations, and Defender SFT for consolidating verifier-accepted repairs.

Results: Extensive evaluations across 1,514 executions demonstrate that CoRL reduces the overall attack success rate (ASR) by 38.5 percentage points to 0.0% while increasing task utility by 13.1 points to 76.3%. Ablation studies and external benchmarks confirm the effectiveness of online co-evolution and population-mined repairs, highlighting the framework's strong transferability in attack resistance. Ultimately, CoRL enables defenders to optimally balance safety and utility against adaptive threats, while retaining attacker models for robust red-teaming.

Abstract

Tool-augmented language agents are vulnerable to indirect prompt injection (IPI). Unlike direct prompt injection, IPI hides adversarial instructions in untrusted tool outputs and can covertly alter the execution of a legitimate task. Defenses trained on fixed attacks may fail as an attacker changes its strategy, injection site, and payload. To address this problem, we formulate adaptive IPI as an asymmetric, partially observable, general-sum Markov game: a multi-turn attacker adapts payloads at reached tool-return sites from the public trajectory, while a tool-using defender must block the injected objective and complete the user task. We propose CoRL, a verifier-grounded co-evolution and repair framework with three stages: Attacker SFT initializes multi-turn attacks from successful trajectories; bilateral Co-PPO jointly trains both agents with role-specific rewards and historical opponent populations; and Defender SFT consolidates verifier-accepted teacher repairs for population-discovered failures. Across 1,514 clean, fixed-template, and adaptive executions per defender, CoRL reduces overall ASR by 38.5 points to 0.0% and raises utility by 13.1 points to 76.3%. Stage-wise and controlled ablations show positive contributions from online Co-PPO and population-mined repair, while external-benchmark evaluation indicates transfer in attack resistance. The defender balances safety and task utility under the evaluated attacks, while the retained attackers provide candidates for adaptive red-team evaluation.

Robust Decentralized Personalized Federated Learning via Prediction-Constrained Neighborhood Collaboration

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07312

AI Summary (中文)

背景：去中心化个性化联邦学习（DPFL）有效缓解了中心服务器的通信瓶颈并保护了数据隐私，但现有依赖纯模型聚合的方法在面临拜占庭攻击时表现出严重的脆弱性。

方法与创新：本文提出了一种鲁棒的去中心化个性化联邦学习方法（R-DPFL）。该方法创新性地摒弃了传统的纯模型聚合范式，转而通过鲁棒的邻域方向估计和基于历史的更新趋势预测来抵御恶意攻击。具体而言，R-DPFL 的执行分为三步：首先，客户端聚合接收到的邻域更新向量以计算当前轮次的模型更新；其次，利用历史更新值与本地模型变化，预测当前更新的理论期望；最后，计算实际聚合更新与预测更新之间的差值，对其进行自适应裁剪后，将其叠加至本地模型更新中。

理论与发现：通过严格的数学分析，本文证明了 R-DPFL 的收敛性。研究发现，在无需强制邻域模型达成共识的前提下，诚实客户端能够在拜占庭邻居的恶意扰动下，依然保持稳定的个性化梯度下降动态。

实验结果：在 CIFAR-10 数据集上的广泛实验表明，在数据异构与对抗性攻击的复杂场景下，R-DPFL 的鲁棒性和准确率均持续优于当前最先进的去中心化和个性化联邦学习基线模型。

AI Summary (English)

Existing decentralized personalized federated learning (DPFL) methods typically rely on pure model aggregation, making them highly vulnerable to Byzantine attacks where malicious clients send corrupted updates. To address this critical vulnerability, we propose R-DPFL, a robust DPFL framework that mitigates adversarial impacts via robust neighborhood direction estimation and history-based update trend prediction rather than direct model aggregation. Specifically, R-DPFL calculates the current model update by aggregating received neighborhood vectors, predicts the expected update based on historical trends and local changes, and adaptively clips the difference between the actual and predicted updates before adding it to the local model. Rigorous theoretical analysis proves the convergence of this learning process, demonstrating that honest clients can maintain stable personalized descent dynamics under Byzantine perturbations without requiring strict consensus among neighboring models. Extensive experiments on the CIFAR-10 dataset confirm that R-DPFL consistently outperforms state-of-the-art decentralized and personalized federated learning baselines, showing superior robustness and accuracy in highly heterogeneous and adversarial settings.

Abstract

This paper proposes a robust decentralized personalized federated learning method R-DPFL, that enables clients to reduce the impact of Byzantine attacks via robust neighborhood direction estimation and history-based update trend prediction, rather than purely aggregating client models as in the existing work. In R-DPFL, each client first computes the current-round model update by aggregating the received neighborhood update vectors. It then predicts what this update should be based on its historical values and local model changes. Finally, R-DPFL computes the difference between these two quantities, adaptively clips this difference, and adds it to the local update. We prove convergence of the learning process through rigorous analysis and show that honest clients maintain stable personalized descent dynamics under Byzantine neighbor perturbations without requiring consensus among neighboring models. Extensive experiments on CIFAR-10 demonstrate that RDPFL consistently outperforms state-of-the-art decentralized and personalized federated learning baselines under heterogeneous and adversarial settings.

Robust Decentralized Federated Distillation via Multi-Modality Knowledge Collaboration

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07230

AI Summary (中文)

背景：随着边缘计算和任务导向型无人机协作等去中心化环境对联邦学习需求的激增，客户端常面临模型异构、数据非独立同分布（non-IID）以及针对特定接收者的拜占庭恶意预测攻击等严峻挑战。

方法：本文提出一种基于多模态知识协作的鲁棒去中心化联邦蒸馏方法，允许异构模型客户端通过共享无标签公共数据进行高效协作。具体而言，各客户端首先从类别预测、边界决策和预测相关性三种模态评估接收到的预测，过滤不可靠客户端并分配基于可靠性的权重，进而为每类知识构建教师模型。随后，利用私有数据计算的监督梯度对蒸馏梯度进行严格验证，剔除冲突的预测与边界梯度，并抑制冲突的关系梯度，最终完成模型更新。

创新与发现：在理论与实验方面，本文严格证明了该方法的收敛性，表明跨模态融合能够将拜占庭攻击对蒸馏梯度和个体私有梯度的负面影响限制在有界范围内，从而确保诚实客户端的稳定局部优化。在CIFAR-10和CIFAR-100数据集上的广泛实验表明，该方法在非独立同分布数据和拜占庭攻击下显著提升了客户端异构模型的预测精度。本研究为不可靠真实世界场景中分布式学习的部署提供了极具潜力的解决方案。

AI Summary (English)

Background & Objective: To address the critical challenges of model heterogeneity, non-independent and identically distributed (non-IID) data, and receiver-specific Byzantine attacks in decentralized environments like edge computing, this paper proposes a robust decentralized federated distillation method via multi-modality knowledge collaboration.

Methodology: Specifically, clients evaluate shared unlabeled public data across three distinct modalities—class prediction, boundary decision, and prediction correlation—to effectively filter unreliable peers, construct modality-specific teachers, and validate distillation gradients using private supervised gradients by systematically removing or suppressing conflicting gradients.

Theoretical & Experimental Contributions: Theoretically, we rigorously prove the algorithm's convergence by demonstrating that cross-modality fusion successfully bounds the Byzantine influence on both distillation and private gradients, thereby ensuring stable local optimization for honest clients. Extensive experiments on CIFAR-10 and CIFAR-100 demonstrate that our method significantly improves the prediction accuracy of heterogeneous models under non-IID data and Byzantine attacks, highlighting its great potential for unreliable real-world decentralized applications.

Abstract

This paper propose a robust decentralized federated distillation method that enables clients with heterogeneous models to collaborate through predictions on shared unlabeled public data. In the proposed method, each client first evaluates the received predictions in three modalities of class prediction, boundary decision, and prediction correlation. It then filters unreliable clients, assigns reliability-based weights to the retained clients, and constructs a teacher for each type of knowledge. Finally, the corresponding distillation gradients are validated using a supervised gradient computed from private data. Conflicting prediction and boundary gradients are removed, and conflicting relation gradients are suppressed before the final model update. We prove the convergence of the proposed method by showing stable local optimization for honest clients under Byzantine distillation. Particularly, we show that our method ensures a bounded Byzantine influence on both distillation gradients and individual client private gradients after cross-modality fusion, thereby enabling stable local optimization for honest clienunder Byzantine distillation. Extensive experiments on CIFAR-10 and CIFAR-100 demonstrate that the proposed method improves the prediction accuracy of heterogeneous models of clients under non-IID data and Byzantine attacks. As the booming demands of federated learning in decentralized environments such as edge computing and mission-oriented UAV collaborations, our method has a great potential for adoption of DFL in unreliable real-world scenarios where clients are exposed to receiver-specific Byzantine messages of malicious predictions.

FedRAW: Preserving Rare-Label Influence in Asynchronous Federated Learning

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07192

AI Summary (中文)

研究背景：异步联邦学习通过服务器端缓冲区实时聚合客户端更新，显著提升了系统的可扩展性。然而，这种到达驱动的聚合机制在客户端参与度异构的情况下，容易悄然扭曲模型的表示学习过程。

问题发现：本文识别出一种名为“静默稀有性失败”（silent rarity failure）的隐蔽失效模式。在此模式下，持有稀有标签的客户端对全局模型的贡献被严重削弱，尽管模型的整体准确率看似未受明显影响。该问题源于两个耦合效应：一是参与偏差，即稀有标签客户端因设备较慢或可用性低而提交更新频率较低；二是聚合偏差，即标准的异步聚合机制未能对这类客户端进行影响力补偿。

方法提出：为此，本文提出 FedRAW，一种完全在服务器端执行的聚合方法。该方法无需修改本地训练、客户端目标或通信协议。FedRAW 创新性地结合了客户端级更新去重（防止高频到达的客户端重复主导更新缓冲区）与稀有标签感知加权（提升携带低覆盖率标签客户端的影响力），从而有效保留稀有标签在模型训练中的作用。

主要发现与结果：本文从理论上形式化了参与偏差与聚合偏差。在 EMNIST Balanced、CIFAR-10、HAM10000 和 ISIC-2019 四个数据集上的广泛实验表明，FedRAW 在保持全局准确率相当且服务器端计算开销可忽略不计的前提下，显著提升了稀有标签的分类准确率，有效克服了静默稀有性失败问题。

AI Summary (English)

Background & Problem: Asynchronous federated learning enhances scalability by aggregating client updates as they arrive; however, it suffers from "silent rarity failure," a hidden mode where clients with rare labels contribute insufficiently to the global model due to coupled participation and aggregation biases.

Method: To address this, we propose FedRAW, a fully server-side aggregation method that preserves rare-label influence without altering local training, client objectives, or communication protocols. FedRAW uniquely integrates client-level update deduplication to prevent frequently arriving clients from repeatedly dominating the update buffer, alongside rare-label-aware weighting to amplify the impact of clients carrying low-coverage labels.

Results: We formally characterize silent rarity failure through participation and aggregation bias, proving that FedRAW effectively increases rare-label client influence over uniform aggregation. Extensive experiments across four datasets (EMNIST Balanced, CIFAR-10, HAM10000, and ISIC-2019) demonstrate that FedRAW significantly improves rare-label accuracy while maintaining comparable global performance and adding negligible server-side computational overhead.

Abstract

Asynchronous federated learning improves scalability by updating the global model from a server-side buffer of client updates as they arrive, rather than waiting for all selected clients to finish. While efficient, this arrival-driven aggregation can silently distort representation learning under heterogeneous participation. We identify silent rarity failure, a hidden failure mode in which clients holding rare labels contribute too weakly to the global model even though its overall accuracy appears largely unaffected. This failure arises from two coupled effects: rare-label clients may submit updates less frequently when they are slower or less available, creating participation bias; and once their updates enter the buffer, standard asynchronous aggregation assigns them no compensating influence, creating aggregation bias. We propose FedRAW, a fully server-side aggregation method that preserves rare-label influence without changing local training, client objectives, or communication protocols. FedRAW combines client-level update deduplication, which prevents frequently arriving clients from repeatedly dominating the update buffer, with rare-label-aware weighting, which increases the influence of clients carrying low-coverage labels. We formalize silent rarity failure through participation and aggregation bias, and show that FedRAW increases rare-label client influence over uniform aggregation while preserving convergence. Across EMNIST Balanced, CIFAR-10, HAM10000, and ISIC-2019, FedRAW improves rarelabel accuracy while preserving comparable global accuracy and adding negligible server-side computation.

Fine-grained Distributed Backdoor Attacks in Federated Learning

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07147

AI Summary (中文)

研究背景：联邦学习作为一种隐私保护的分布式机器学习范式，面临着严重的后门攻击威胁。相比于集中式攻击，分布式后门攻击危害更大，但需要更多的中毒样本来弥补触发器强度分解带来的损失，且固定的触发模式容易被鲁棒聚合算法检测，增加了攻击暴露的风险。

核心方法：为应对上述挑战，本文提出了一种细粒度分布式后门攻击框架（FDBA）。该框架通过动态触发器生成和嵌入向量优化，以更少的中毒样本实现高效攻击。首先，设计了基于图像边缘结构的动态触发器生成方法，利用Canny算法提取边缘特征并注入拉普拉斯噪声，同时应用RGB通道分解实现分布式触发器的隐蔽适配，降低检测几率。其次，引入嵌入向量对比学习策略，迫使中毒样本在特征空间中逼近目标类中心，从而显著提升攻击效能。

主要发现与创新：在CIFAR-10数据集上的实验表明，当目标攻击成功率（ASR）在70%至90%之间时，FDBA相比传统DBA方法将所需的中毒比例大幅降低了37.4%至48.4%。在非独立同分布（Non-IID）场景下，即使在极端数据异构条件下，FDBA仍能保留84.7%的独立同分布攻击性能，远超DBA的73.5%，并成功绕过主流防御机制。本研究为联邦学习安全提供了新视角，深刻揭示了细粒度分布式攻击的潜在威胁与防御挑战。

AI Summary (English)

Federated learning faces severe threats from distributed backdoor attacks, which typically require more poisoned samples and are vulnerable to robust aggregation defenses due to their fixed trigger patterns. To address these limitations, we propose a Fine-grained Distributed Backdoor Attack (FDBA) framework that leverages dynamic trigger generation via edge-based features with Laplacian noise and RGB channel decomposition, combined with an embedding vector contrastive learning strategy to minimize the required poisoning ratio. Extensive experiments on CIFAR-10 demonstrate that FDBA reduces the required poisoning ratio by 37.4% to 48.4% compared to traditional Distributed Backdoor Attacks (DBA) while achieving target attack success rates between 70% and 90%. Furthermore, under extreme Non-IID data heterogeneity, FDBA retains 84.7% of its IID attack performance, significantly outperforming DBA's 73.5%, and successfully bypasses mainstream defense mechanisms. This study highlights the critical security challenges and potential threats posed by fine-grained distributed attacks in federated learning environments.

Abstract

Federated learning, as a privacy-preserving distributed machine learning paradigm, faces significant threats from backdoor attacks. Compared to centralized attacks, distributed backdoor attacks are more harmful but require more poisoned samples to compensate for the loss of trigger strength due to decomposition. Fixed trigger patterns are also easily detected by robust aggregation algorithms, increasing the risk of attack exposure. To address these challenges, we propose a fine-grained distributed backdoor attack framework (FDBA). This framework uses dynamic trigger generation and embedding vector optimization to perform attacks with fewer poisoned samples. First, we design a dynamic trigger generation method based on image edge structures using the Canny algorithm to extract edge features, which are then injected with Laplacian noise. RGB channel decomposition is applied for covert adaptation of the distributed trigger, reducing detection chances. Second, we introduce an embedding vector contrastive learning strategy that forces poisoned samples to approach the target class center in the feature space, enhancing attack effectiveness. On CIFAR-10, piecewise-linear estimates for target ASRs between 70\% and 90\% show that FDBA reduces the required poisoning ratio by 37.4\%--48.4\% compared with DBA. In non-independent and identically distributed (Non-IID) scenarios, FDBA retains 84.7\% of its IID attack performance under extreme heterogeneity, whereas DBA drops to 73.5\%, and the framework successfully bypasses mainstream defense mechanisms. This study offers new insights into federated learning security and emphasizes the potential threats and defense challenges posed by fine-grained distributed attacks.

Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07063

AI Summary (中文)

基于本地差分隐私（LDP）的图学习协议作为去中心化图学习的重要范式，有效平衡了隐私保护与学习效用。在该协议下，用户在本地扰动节点特征和邻接信息，确保原始数据不出设备。然而，其固有的开放参与特性使其面临严重的数据投毒攻击威胁，攻击者可注入精心构造的恶意节点以破坏邻域聚合，从而降低下游任务效用，而针对此威胁的有效防御机制尚未得到充分探索。

为此，本文提出 VERITAS，一种基于“信任但验证”（trust-but-verify）范式的抗投毒本地私有图学习协议。VERITAS 创新性地引入验证列表以编码分级的同伴信任水平，在用户端联合实现节点特征与图结构的私有化，同时在服务器端利用双边证明的不对称性来精准识别并剪枝恶意节点。具体而言，VERITAS 包含四个协同阶段：(1) 局部数据扰动；(2) 证明驱动的恶意节点剪枝；(3) 基于双重去噪的效用恢复；(4) 鲁棒的私有图学习。

在四个真实世界基准数据集上的广泛实验表明，跨越多种 LDP 机制与 GNN 架构，VERITAS 不仅能有效防御数据投毒攻击，还能在严格的隐私保证下显著提升下游图学习的实用性与鲁棒性。

AI Summary (English)

Locally private graph learning protocols based on local differential privacy (LDP) effectively balance privacy protection and learning utility; however, their inherently open participation nature renders them critically vulnerable to data poisoning attacks, a severe threat for which effective defenses remain largely unexplored. To address this challenge, we propose VERITAS, a poisoning-resilient protocol built on a "trust-but-verify" paradigm. VERITAS introduces a verification list to encode graded peer trust levels, jointly privatizes node features and graph structures on the user side, and exploits bilateral attestation asymmetry on the server side to accurately identify and prune malicious nodes. The protocol operates through four synergistic stages: local data perturbation, attestation-driven malicious node pruning, utility restoration via dual denoising, and robust private graph learning. Extensive experiments across four real-world benchmark datasets, multiple LDP mechanisms, and various GNN architectures demonstrate that VERITAS effectively defends against data poisoning attacks while significantly improving downstream graph learning utility under rigorous privacy guarantees.

Abstract

Built upon local differential privacy (LDP), locally private graph learning protocols have emerged as an important paradigm for decentralized graph learning, balancing privacy protection and learning utility. Under such protocols, each user locally perturbs their node features and adjacency information before transmission, ensuring formal privacy guarantees without original data leaving the device. However, the inherently open participation nature renders these protocols critically vulnerable to data poisoning attacks, where adversaries inject carefully crafted malicious nodes to corrupt neighborhood aggregation and degrade downstream utility. Despite the severity of this threat, effective defenses in this setting remain largely unexplored. In this paper, we propose VERITAS, a poisoning-resilient locally private graph learning protocol built on a trust-but-verify paradigm. By introducing a verification list encoding graded peer trust levels, VERITAS jointly privatizes node features and graph structure on the user side, while exploiting bilateral attestation asymmetry on the server side to identify and prune malicious nodes. Concretely, VERITAS comprises four synergistic stages: (1) local data perturbation, (2) attestation-driven malicious node pruning, (3) utility restoration via dual denoising, and (4) robust private graph learning. Extensive experiments on four real-world benchmark datasets across multiple LDP mechanisms and GNN architectures demonstrate that VERITAS effectively defends against data poisoning attacks and significantly improves downstream graph learning utility under rigorous privacy guarantees.

MOLE: Detecting Insider Threats in AI Agents

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06966

AI Summary (中文)

研究背景与动机

随着AI代理的广泛应用，模型未对齐、提示词注入或操作员滥用等风险，可能导致AI代理在操作前沿实验室账户时，执行窃取模型权重、投毒训练数据或削弱发布门禁等内部威胁。然而，现有的评估基准并未测试防御者能否在有限的审查预算下，从常规工作中检测出此类恶意活动。

方法：MOLE 基准

为此，本文引入了 MOLE，一个用于检测AI代理内部威胁的开放基准。该基准模拟了150个AI操作的账户，在30个工作日内共享9个有状态服务。MOLE包含了12种具体的威胁场景，以及来自4个不同模型的8个语料库，数据总量高达约200亿个token。

主要发现

通过对39个代理模型的评估发现，72%的模型能够完成大部分分配的有害目标，且代理表现出的“拒绝”行为并不能有效预测其最终是否会完成有害任务。此外，研究对比了40种监控器在不同语料库生成器、可观测性级别和威胁类型下的表现。结果显示，即便是单日审计事件对比中表现最优的监控器，仍会漏报近一半已完成的有害行为。

创新点与应用价值

MOLE不仅用于评估，还赋能监控器的开发。研究表明，通过基准指导的搜索，可将中端监控器的检测性能提升49%至64%。同时，在建模成本相当的前提下，选择性地部署更强的监控器，可使预算-AUC（曲线下面积）提升10%，为实际部署提供了高效的成本优化策略。

AI Summary (English)

Background and Motivation

AI agents operating frontier-lab accounts pose severe insider threats, such as model weight exfiltration and training data poisoning, yet existing benchmarks fail to evaluate whether defenders can detect these malicious activities hidden within routine workflows under limited review budgets.

Methodology: The MOLE Benchmark

To address this gap, we introduce MOLE, an open benchmark comprising 150 AI-operated accounts sharing 9 stateful services over 30 workdays, incorporating 12 distinct threats and 8 corpora totaling approximately 20 billion tokens to evaluate 40 different monitors.

Key Findings and Contributions

Our extensive evaluation reveals that 72% of 39 agent models successfully complete most assigned harmful objectives, and notably, agent refusal does not predict task completion, while even the best-evaluated monitor misses nearly half of the completed harms. Crucially, MOLE also drives monitor development: benchmark-guided search improves mid-tier monitors by 49-64%, and the selective deployment of stronger monitors enhances budget-AUC by 10% at comparable modeled costs, offering a highly efficient strategy for real-world threat detection.

Abstract

Model misalignment, prompt injection, or operator misuse could lead AI agents operating frontier-lab accounts to exfiltrate model weights, poison training data, or weaken release gates. Existing benchmarks do not test whether defenders can detect this activity among routine work under a limited review budget. We introduce MOLE, an open benchmark of 150 AI-operated accounts sharing 9 stateful services over 30 workdays, with 12 threats and 8 corpora from four models totaling roughly 20 billion tokens. Of 39 agent models, 72% complete most assigned harmful objectives and agent refusal does not predict completion. MOLE enables comparison of 40 monitors across corpus generators, observability levels, and threats; even the best evaluated monitor in our single-day audit-event comparison misses nearly half of completed harm. MOLE also enables monitor development: benchmark-guided search improves a mid-tier monitor by 49-64%, while selective use of a stronger monitor improves budget-AUC by 10% over applying it to every account-day at comparable modeled cost.

Does Syntax Matter? A Graph-Augmented Variational Topic Model for Computational Social Sciences

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07797

AI Summary (中文)

背景与动机：主题建模在计算社会科学中广泛用于识别大规模文本语料库中的潜在主题。传统方法依赖词袋表示和LDA等生成模型，而近期方法（如BERTopic）则基于密集的文档嵌入。

方法与创新：本文提出结构上下文概率主题模型（SCPTM），该架构创新性地将句法依赖关系融入主题推断过程。SCPTM将语料库表示为由词汇和句法边连接的文档与词语异构图，并通过变分自编码器（VAE）内的图注意力网络（GAT）进行处理，从而生成概率性的混合成员主题分布。

实验与发现：我们在四个语体和话语结构各异的语料库上，评估了七种主题建模技术（含四种SCPTM消融实验）。结果表明：
* 对齐提升：SCPTM的神经架构在文档-主题对齐方面较生成基线有显著提升，但这主要归功于变分编码器而非句法结构本身。
* 多样性与描述符：句法结构有效提升了主题多样性，图增强变体在所有语料库中均优于无图基线。同时，依赖路径能精准捕获审议语体中的谓词-论元结构和立场，但在技术和机构语料库中则显得冗余。
* 效价差：所有变体的效价差均为正，但主要由短语分组而非句法过滤驱动。

结论：句法编码的作用具有条件性。它显著有利于行动导向和辩论性文本，但会在纯信息性或行政语体中引入噪声，凸显了句法特征在计算社会科学中的语境依赖性。

AI Summary (English)

This paper introduces the Structural Contextual Probabilistic Topic Model (SCPTM), a novel graph-augmented variational autoencoder architecture that integrates syntactic dependency relations into topic inference by representing corpora as heterogeneous graphs processed via Graph Attention Networks. Evaluated across four diverse corpora using comprehensive coherence, diversity, and phrase-level diagnostics, SCPTM's neural architecture significantly improves document-topic alignment over traditional generative baselines, though these gains are primarily driven by the variational encoder rather than syntax itself. Crucially, our empirical findings reveal that syntactic encoding conditionally enhances topic diversity and descriptor quality, effectively capturing predicate-argument structures and stance in deliberative texts while proving redundant in technical or administrative corpora. Ultimately, we conclude that while graph-augmented syntactic encoding greatly benefits action-oriented and argumentative texts, it introduces unnecessary noise in purely informational registers, highlighting the highly context-dependent value of syntax in computational social sciences.

Abstract

Topic modeling is widely used in computational social sciences to identify latent themes in large text corpora. Traditional approaches rely on Bag-of-Words representations and generative models such as LDA, while recent methods like BERTopic operate on dense document embeddings. This paper introduces the Structural Contextual Probabilistic Topic Model (SCPTM), an architecture that incorporates syntactic dependency relations into topic inference. SCPTM represents a corpus as a heterogeneous graph of documents and words connected by lexical and syntactic edges, processed through a Graph Attention Network within a Variational Autoencoder to produce probabilistic, mixed-membership topic distributions. We evaluate seven topic modeling techniques (including four SCPTM ablations) across four corpora differing in register and discourse structure. Our framework combines coherence (C_V, C_NPMI), topic diversity, clustering-label alignment (NMI), and phrase-level diagnostics (complementarity and valence gap). Results show that SCPTM's neural architecture yields substantial gains in document-topic alignment over generative baselines, but these gains are attributable to the variational encoder rather than to syntax. Syntax contributes to topic diversity, where graph-augmented variants outperform the no-graph baseline across all corpora, and to descriptor quality: dependency paths capture predicate-argument structures and stance in deliberative registers, while proving redundant in technical and institutional corpora. The valence gap is positive across all variants, but driven primarily by phrase grouping rather than syntactic filtering. We conclude that syntactic encoding matters conditionally: it benefits action-oriented, argumentative texts, but introduces noise in informational or administrative registers.

BlueprintAgent: Constraint-Triggered Targeted Revisits for Simulation-Ready Generation from Scanned Structural Blueprints

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07362

AI Summary (中文)

将服役中的钢筋混凝土（RC）建筑结构蓝图转化为可用于仿真的模型（即支持确定性有限元导出和工程师审查的结构化框架表示），是安全评估和抗震加固的基础，但该过程目前仍高度依赖人工。直接使用多模态大语言模型（MLLM）处理扫描图纸往往不可靠，其输出经常违反梁柱支撑、跨度数量或3D连续性等工程约束。

为此，本文提出了 BlueprintAgent (BPA)，一种用于从扫描蓝图中提取仿真就绪框架的约束触发多模态智能体。BPA 将 MLLM 作为核心阅读器和决策者，并结合 OCR 与计算机视觉技术提供局部证据。其核心创新机制在于：将工程约束转化为可调用的验证器，当检测到实体级冲突时，会触发 MLLM 对局部区域进行定向重访（targeted revisits）。这种推理时控制机制显著区别于固定流水线或自由形式的自我反思。

我们在来自 20 个匿名 RC 框架项目的 300 张真实扫描蓝图上对 BPA 进行了评估。实验对比了 5 种基线模型和 6 种消融设置。结果表明，BPA 的梁（Beam）宏平均 F1 分数高达 0.994，远超单次 MLLM 零样本提示（0.301）和固定流水线（0.820）。消融实验进一步证明，移除 MLLM 主导的轴线裁决会导致复杂多页项目中的梁柱 F1 分数大幅下降。

研究结论指出，针对密集的技术图纸，工程约束不应仅作为事后的输出过滤器，而应被部署为触发实体级定向重访的机制，以实现高精度的仿真模型生成。

AI Summary (English)

Converting scanned reinforced-concrete building blueprints into simulation-ready structural models is crucial for safety assessment but remains heavily manual, as direct multimodal large language model (MLLM) prompting often violates critical engineering constraints. We introduce BlueprintAgent (BPA), a constraint-triggered multimodal agent that utilizes an MLLM as the primary decision-maker, supplemented by OCR and computer vision for localized evidence. BPA's core innovation implements engineering constraints as callable validators; entity-level conflict reports trigger targeted MLLM revisits over specific local regions, offering a robust inference-time control mechanism. Evaluated on 300 real scanned blueprint sheets from anonymized projects, BPA achieves a macro-averaged Beam F1 score of 0.994, significantly outperforming both zero-shot MLLM prompting (0.301) and fixed pipelines (0.820). Ultimately, our findings demonstrate that for dense technical drawings, engineering constraints are most effective when deployed as active triggers for entity-level targeted revisits rather than mere post-hoc output filters.

Abstract

Converting in-service reinforced-concrete (RC) building blueprints into simulation-ready models---structured frame representations that support deterministic FEM export and qualified-engineer review---underpins safety assessment and seismic retrofit, but the process remains manual. Direct prompting of a multimodal large language model (MLLM) over a scanned sheet is unreliable: outputs often violate engineering constraints on beam--column support, span count, or 3D continuity. We present BlueprintAgent (BPA), a constraint-triggered multimodal agent for simulation-ready frame extraction from scanned blueprints. BPA treats the MLLM as the primary reader and decision maker, with OCR and computer vision supplying localized evidence. Its central mechanism realizes engineering constraints as callable validators whose entity-level conflict reports trigger targeted MLLM revisits over the local region---an inference-time control distinct from fixed pipelines and free-form self-reflection. We evaluate BPA on 300 real scanned blueprint sheets from 20 anonymized RC frame projects, against five baselines and six ablations. BPA reaches a macro-averaged Beam F1 of 0.994, against 0.301 for single-MLLM zero-shot and 0.820 for a fixed pipeline; removing MLLM-led axis adjudication collapses Beam and Column F1 on complex multi-sheet projects. For dense technical drawings, engineering constraints are best deployed as triggers for entity-level targeted revisits rather than as post-hoc output filters.

Probing the Structure and Dynamics of LLM Value Expression through Value Conflicts

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07296

AI Summary (中文)

背景：大型语言模型（LLMs）的伦理评估通常将其价值观视为静态和单一的。然而，本文提出LLM的价值观表达实际上是一个结构化且动态的现象。

方法：为了探究这一特性，研究团队引入了“冲突驱动的价值观探测（Conflict-driven Value Probing）”框架。该框架通过将LLM置于价值冲突情境中，并实施四种干预措施来扰动这些冲突，从而深入探测其价值观表达机制，并将该框架应用于十个主流LLM。

主要发现：研究识别出三种反复出现的模式：
1. 表达二元性：模型在抽象评估中倾向于广泛的理想主义导向，而在具体冲突中则转向更务实的优先事项。
2. 功能可引导性：模型能够轻松将其表达的价值观特征重新配置为符合任务定义的价值观目标。
3. 有界可塑性：这种重新配置并非毫无限制。外部压力会引发以安全和目标为导向的优先级转移；同时，负面框架能够有效区分受保护的核心价值观与易于被重新引导的价值观。

创新点与意义：综上所述，这些发现全面刻画了LLM价值观表达的结构与动态特征：上下文能够灵活地重新配置表达的优先级，但始终被限制在特定的行为边界内。这一行为学解释为理解和提升LLM的可控性、价值对齐以及安全性奠定了坚实的理论与实证基础。

AI Summary (English)

While ethical evaluations of Large Language Models (LLMs) often treat model values as static and monolithic, this paper reconceptualizes LLM value expression as a structured yet highly dynamic phenomenon. We introduce Conflict-driven Value Probing, a novel framework that situates LLMs in value conflicts and applies four perturbation interventions to probe their value expressions across ten diverse models. Our empirical analysis reveals three recurring patterns: (1) expression duality, where models shift from broad idealistic orientations in abstract contexts to pragmatic priorities in concrete conflicts; (2) functional steerability, enabling models to readily reconfigure their value profiles toward task-defined objectives; and (3) bounded plasticity, demonstrating that such reconfigurations are strictly constrained, with external pressure inducing security-oriented shifts and negative framing effectively distinguishing protected values from those amenable to redirection. Ultimately, these findings comprehensively characterize how context flexibly reconfigures expressed priorities within specific behavioral boundaries, providing a robust foundation for advancing LLM controllability, value alignment, and overall safety.

Abstract

Ethical evaluation of Large Language Models (LLMs) often characterizes model values as static and monolithic. In contrast, we argue that LLM value expression is better understood as a structured yet dynamic phenomenon. To investigate this, we introduce Conflict-driven Value Probing, a controlled framework that places LLMs in value conflicts and implements four types of interventions that perturb these conflicts to probe LLM value expression. Applying this framework to ten LLMs, we identify three recurring patterns. (1) Expression duality: models shift from broad idealistic orientations in abstract assessment toward more pragmatic priorities in concrete conflicts. (2) Functional steerability: models readily reconfigure their expressed value profiles toward task-defined value objectives. (3) Bounded plasticity: such reconfiguration is not without constraints, i.e. pressure induces a security- and goal-oriented priority shift while negative framing distinguishes protected values from those more amenable to redirection. Together, these findings characterize both the structure and dynamics of LLM value expression: context flexibly reconfigures expressed priorities, yet within behavioral boundaries. This behavioral account provides a foundation for understanding controllability, alignment, and safety in LLMs. Code and data are available at https://github.com/ZeroGen-Lab/CFProbe.

SIFTING: A Novel LLM-Based Framework for Structured and Transparent Information Extraction from Clinical Free-Text Reports, with Application to Tumor Staging in Lung Cancer

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.07185

AI Summary (中文)

背景：大型语言模型（LLMs）在从临床自由文本中提取信息方面展现出巨大潜力，但其输出通常缺乏结构化且难以追溯，这给临床工作流中的验证和应用带来了困难。

方法：为此，本研究提出了一种名为 SIFTING 的新型基于 LLM 的框架。该框架结合了 LLM 的语言理解能力与片段级处理技术，通过带有严格输出控制的结构化提示词，将提取的发现与源文本直接链接，从而实现准确且透明的信息提取。为验证其能力，研究将其应用于从 130 份肺癌放射学报告中提取肿瘤 T 分期信息（SIFTING-T-stage）。实验采用完全自托管设置，使用了 4-bit 量化的开源 LLM Llama-3.3-70B（35 GB）的紧凑版本，以确保对数据和模型的完全控制。性能评估以四位临床专家制定的参考标准为准，并与传统单提示词方法下的多种 LLM 进行了对比，采用 Bootstrap 重采样法估计置信区间。

结果：SIFTING-T-stage 针对参考标准达到了 90% 的准确率（95% CI: 84-95）。其性能不仅可与具备推理能力的最大型最先进 LLM 相媲美，且与临床专家的表现具有可互换性（p < 0.001），同时通过源文本引用提供了完全的追溯性。

结论与创新：SIFTING 框架实现了从临床自由文本中进行准确、结构化且可追溯的信息提取。它确保了数据控制、可重复性和可验证的输出，能够有效支持临床验证并促进工作流的无缝整合。

AI Summary (English)

Large language models (LLMs) show significant promise for extracting information from clinical free-text documents; however, their outputs often lack structured formatting and traceability, which complicates validation and hinders adoption in clinical workflows. To address these critical limitations, we introduce SIFTING, a novel LLM-based framework that integrates segment-level processing with structured prompts to link extracted findings directly to the source text, thereby ensuring both accurate and transparent information extraction. When applied to the task of tumor T-stage extraction from 130 lung cancer radiology reports using a fully self-hosted, 4-bit quantized Llama-3.3-70B model, SIFTING achieved an impressive accuracy of 90% (95% CI: 84-95) against an expert-derived reference standard. Notably, its performance is highly comparable to state-of-the-art reasoning LLMs and statistically interchangeable with human clinical experts (p < 0.001), while uniquely providing full traceability through source text references. Ultimately, SIFTING enables accurate, structured, and verifiable extraction from clinical documents, ensuring strict data control and facilitating seamless integration into routine clinical workflows.

Abstract

Background: Large language models (LLMs) show promise for extracting information from clinical free-text documents, but their outputs are often unstructured and lack traceability, complicating validation and adoption in clinical workflows. In this work we introduce SIFTING, an LLM-based framework designed to address these shortcomings. Methods: SIFTING combines the language comprehension capabilities of LLMs with segment-level processing and structured prompts with strict output control, linking findings to the source text to enable both accurate and transparent information extraction. To demonstrate its capabilities, we applied the framework to the task of extracting tumor T-stage information from 130 lung cancer radiology reports (SIFTING-T-stage). A compact 4-bit quantized version of the open-source LLM Llama-3.3-70B (35 GB) was used in a fully self-hosted setup, providing full control over data and model. Performance was evaluated against a reference standard created by four clinical experts and compared with a range of LLMs as used in a conventional single-prompt approach, using bootstrap resampling to estimate confidence intervals. Results: SIFTING-T-stage achieved an accuracy of 90% (95% CI: 84-95) against the reference standard. We found its performance to be comparable to even the largest state-of-the-art LLMs with reasoning capabilities and to be interchangeable with clinical experts (p < 0.001), while at the same time offering full traceability through source text references. Conclusion: SIFTING enables accurate, structured, and traceable information extraction from clinical free-text documents. It ensures data control, reproducibility, and verifiable outputs that can support clinical validation and workflow integration.

Dynamic-Programming-Guided Hierarchical BPE and Empirical Analysis of Vocabulary Pruning

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06898

AI Summary (中文)

研究背景：字节对编码（BPE）通过贪心合并策略构建词汇表，但其固有的合并顺序未必能为固定大小的模型可见词汇表实现最优的压缩分配，限制了模型的编码效率。

研究方法：本文提出了一种动态规划引导的层次化 BPE（DH-BPE）词汇构建方法。该方法创新性地结合了精确最小 token 分割下的 token 暴露度与 BPE 训练过程中产生的层次依赖关系。DH-BPE 从适度超调的 BPE 候选词汇表出发，利用动态规划算法精确评估候选词的效用，并应用暴露度引导且感知依赖关系的剪枝策略，从而科学地筛选出固定大小的最终模型可见词汇表。

主要发现：在 12K 和 16K 目标词汇量的主要评估中，在共享的精确最小 token 动态规划编码器下，DH-BPE 相比标准 BPE、剪枝 BPE 和 MinGram 一致提升了聚合压缩率。尽管 MinGram-PP 在主要对比中表现出更强的聚合压缩，但在跨语料库评估中，DH-BPE 在超调因子 f=2.0 和 3.0 时显著优于 MinGram-PP；仅在 12K 词汇量且候选池极大（f=4.0 和 5.0）时，MinGram-PP 才实现反超。

创新与意义：定性分析表明，DH-BPE 能够有效平衡后期更彻底的 BPE 合并与可重用的子词组件，为在固定模型可见词汇预算约束下优化词汇分配提供了一种切实可行的创新方案。

AI Summary (English)

Byte Pair Encoding (BPE) constructs vocabularies via greedy merging, which often fails to optimally allocate a fixed model-visible vocabulary for optimal compression. To address this limitation, we propose Dynamic-Programming-Guided Hierarchical BPE (DH-BPE), a novel vocabulary-construction method that integrates token exposure under exact minimum-token segmentation with the hierarchical dependencies induced during BPE training. By utilizing dynamic programming to evaluate candidate utility and applying exposure-guided, dependency-aware pruning on a moderately oversized candidate pool, DH-BPE effectively selects an optimal fixed-size vocabulary. Extensive empirical evaluations at 12K and 16K target sizes demonstrate that DH-BPE consistently outperforms Standard BPE, Pruned BPE, and MinGram in aggregate compression. Furthermore, while MinGram-PP shows stronger compression in primary comparisons, DH-BPE achieves superior cross-corpus compression at moderate overshoot factors, only being surpassed when significantly larger candidate pools are used. Ultimately, DH-BPE provides a practical approach to balancing comprehensive late-stage merges with reusable subword components, significantly improving vocabulary allocation under strict model-visible budget constraints.

Abstract

Byte Pair Encoding (BPE) constructs vocabularies through greedy pair merging, but the resulting merge order does not necessarily allocate a fixed model-visible vocabulary optimally for compression. We propose Dynamic-Programming-Guided Hierarchical BPE (DH-BPE), a vocabulary-construction method that combines token exposure under exact minimum-token segmentation with the hierarchical dependencies induced by BPE training. Starting from a modestly overshot BPE candidate vocabulary, DH-BPE uses dynamic programming to measure candidate utility and applies exposure-guided, dependency-aware pruning to select a fixed-size model-visible vocabulary. We compare DH-BPE against Standard BPE and recent vocabulary-optimization baselines, including Pruned BPE, MinGram, and MinGram-PP, in primary evaluations at 12K and 16K target vocabulary sizes, with an additional 18K evaluation against MinGram only. Across the primary 12K and 16K comparisons, DH-BPE consistently improves aggregate compression over Standard BPE, Pruned BPE, and MinGram under a shared exact minimum-token DP encoder. MinGram-PP achieves stronger aggregate compression in the primary comparisons, but DH-BPE outperforms it at overshoot factors f = 2.0 and f = 3.0 in cross-corpus evaluation; at 12K, MinGram-PP reverses this ordering only with the substantially larger candidate pools at f = 4.0 and f = 5.0. Qualitative analysis further shows that DH-BPE balances later, more complete BPE merges with reusable subword components, providing a practical approach to improving vocabulary allocation under a fixed model-visible vocabulary budget.

AIPA: Anonymous Image Provenance Authentication in Online Social Networks via Unlinkable Pseudonym Certificates and zk-SNARKs

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1914

AI Summary (中文)

研究背景：生成式AI的普及使得高保真深度伪造图像易于生成并在在线社交网络（OSN）中广泛传播。虽然公开验证图像来源（即图像的出处及编辑历史）是打击深度伪造的有效手段，但现有的行业标准（如C2PA）高度依赖可信软硬件。基于密码学的图像认证方案虽能消除对可信编辑器的依赖，但在OSN中部署时面临三大挑战：保护签名者隐私、在多次编辑中维持来源真实性，以及确保高效的验证过程。

核心方法：为解决上述问题，本文提出了一种匿名图像来源认证方案（AIPA）。首先，设计了基于匿名凭证的不可链接伪名证书方案（UPCS），将在线签名与验证降至普通数字签名级别（仅需0.017ms和0.066ms），有效保障了签名者的匿名性。其次，结合UPCS、zk-SNARKs（零知识简洁非交互式知识论证）与哈希链技术构建AIPA方案，确保图像在互不信任的编辑者间传播时，其来源与编辑历史的真实性，同时严格保护隐私。最后，为实现OSN中的高效验证，引入了GPU加速的图像证明系统VIMz-Lou，其内置专用JPEG压缩电路，证明大小恒定在448字节。

主要发现与创新：本文对UPCS和AIPA进行了严格的安全性形式化证明，并在模拟OSN环境中实现了端到端工作流。实验结果表明，该方案生成的完整多编辑来源谱系数据量仅为40.2 KB（仅占原图的6.5%），且整体验证时间仅需4.28秒。本研究在保障用户隐私的前提下，实现了轻量、高效且安全的图像来源认证，为OSN中的深度伪造治理提供了创新的技术路径。

AI Summary (English)

Background & Objective: While cryptographic image provenance authentication combats deepfakes in online social networks (OSNs) without relying on trusted hardware, it faces significant challenges regarding signer privacy, maintaining provenance integrity across multiple edits, and ensuring verification efficiency. Methods: To address these issues, we propose the Anonymous Image Provenance Authentication (AIPA) scheme. AIPA integrates an Unlinkable Pseudonym Certificate Scheme (UPCS) to guarantee signer anonymity with minimal overhead, utilizes zk-SNARKs combined with hash chains to preserve provenance authenticity across untrusted editors, and introduces VIMz-Lou, a GPU-accelerated proof system with a dedicated JPEG-compression circuit for rapid verification. Results & Contributions: Formally proven secure, our end-to-end implementation in a simulated OSN environment demonstrates that AIPA generates a highly compact multi-edit provenance lineage of merely 40.2 KB (only 6.5% of the original image size) and completes full verification in just 4.28 seconds, providing a robust, privacy-preserving, and highly efficient framework for deepfake mitigation in OSNs.

Abstract

Generative AI has made high-fidelity deepfakes easy to produce, and online social networks (OSNs) spread them widely across users and platforms. Publicly verifying an image's provenance, i.e., where an image came from and what edits it has undergone, can help combat deepfakes. The Coalition for Content Provenance and Authenticity (C2PA) offers an industry standard, but depends on trusted software and hardware. Through digital signatures and zero-knowledge proofs, cryptographic image authentication eliminates the reliance on trusted editors. However, deploying such schemes in OSNs faces three problems: preserving signer privacy, maintaining provenance authenticity across edits, and ensuring efficient verification. To ensure signer anonymity in image provenance, we propose an unlinkable pseudonym certificate scheme (UPCS) based on anonymous credentials, which reduces online signing and verification to ordinary digital signature operations taking only 0.017 and 0.066 ms. Building on UPCS, zk-SNARKs, and hash chains, we propose an anonymous image provenance authentication (AIPA) scheme, ensuring the authenticity of provenance and editing history of an image as it propagates across mutually untrusted editors, while preserving signer privacy. To achieve efficient verification in OSNs, we introduce VIMz-Loua, a GPU-accelerated image proof system with a dedicated JPEG-compression circuit, whose proofs remain a constant 448 B and verify in 6-12 ms across image sizes. We formally prove the security of UPCS and AIPA, and implement an end-to-end workflow in a simulated OSN environment, where the full multi-edit provenance lineage is only 40.2 KB (6.5% of the published image), and is verified in 4.28 s.

A RAM-Efficient Implementation of Falcon

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1915

AI Summary (中文)

研究背景：后量子密码学在资源受限的嵌入式设备（如智能卡）中的部署面临着内存和计算资源的严峻挑战。Falcon作为一种基于格的先进数字签名算法，其原始实现对RAM的需求较高，限制了其在微型设备上的应用。本文提出了一种针对Falcon算法的极低内存高效实现方案。

方法与创新：本研究引入了多种底层优化技术。首先，设计了一种快速傅里叶变换（FFT）的新型变体；其次，采用模整数计算替代了部分传统的浮点运算，成功移除了超过一半的浮点操作；再次，在快速傅里叶采样过程中创新性地引入了输入加法的延迟处理机制；最后，提出了一种替代的签名重组流程。

主要发现：相较于前代Falcon-512实现，新方案的RAM占用量实现了大幅缩减，从约31 kB显著降低至约11 kB。此外，该实现在Arm Cortex-M4微控制器上展现出更卓越的性能，平均签名生成开销降至1345万次时钟周期。本方案使Falcon完全满足智能卡等小型嵌入式系统的严苛资源限制。

AI Summary (English)

Core Contributions: This paper presents a highly RAM-efficient implementation of the Falcon signature scheme, significantly reducing the memory footprint from approximately 31 kB in the previous Falcon-512 version to merely 11 kB. This drastic reduction makes the algorithm highly viable for severely resource-constrained environments like smart cards.

Key Optimizations: The proposed approach introduces several novel techniques, including a new variant of the Fast Fourier Transform (FFT), the substitution of numerous floating-point operations with modular integer arithmetic (eliminating over half of the floating-point calculations), delayed input addition during Fast Fourier sampling, and an alternative signature reassembly process.

Key Results: Consequently, the optimized implementation not only achieves a remarkably small memory footprint but also demonstrates enhanced computational performance on the Arm Cortex-M4 platform, with the average signature generation cost successfully reduced to 13.45 million cycles.

Abstract

We present a RAM-efficient implementation of Falcon: RAM usage has shrunk to about 11 kB, down from about 31 kB in the previous implementation of Falcon-512. This code is furthermore faster on Arm Cortex M4, with average signature generation cost down to 13.45 million cycles. Optimization techniques include a novel variant of the FFT, replacement of some floating-point operations with modular integer computations, delayed addition of input within the Fast Fourier sampling process, and an alternate signature reassembly process. More than half of the floating-point operations have been removed. The resulting implementation is now small enough to allow use in small embedded systems such as smart cards.

A Generalized Wiener-type Attack Against a Family RSA-like Cryptosystems

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1908

AI Summary (中文)

研究背景：在现代公钥密码学领域，RSA算法及其变体一直扮演着核心角色。设 $N=pq$ 为两个平衡素数之积。2023年，Cotan与Teșeleleanu提出了一族新颖的类RSA密码系统，其核心依赖于密钥方程 $ed - k(p^n - 1)(q^n - 1) = 1$（其中 $n \geq 1$）。特别地，当 $n=1$ 时，该系统即为经典RSA算法；当 $n=2$ 时，则对应Elkamchouchi等人提出的变体方案。

研究方法：针对该密码系统家族在 $n = 2^i$（$i > 2$ 且为整数）这一特定参数情形下的安全性，本文提出了一种广义的Wiener型攻击策略。该研究创造性地将经典的连分数算法与先进的基于格（lattice-based）的归约技术深度融合，构建了一种高效的密钥恢复攻击模型。

主要发现与创新点：本攻击方法成功突破了 $n = 2^i$ 情形下的密钥方程限制。这不仅是对先前针对 $n=1, 2, 4$ 情形研究成果的自然延续与理论推广，更在密码分析技术上实现了重要创新。本文的研究成果精确刻画了该类密码系统的安全边界，揭示了在特定指数参数下系统面临的潜在风险，为未来相关密码体制的参数选取与安全设计提供了关键的理论依据与警示。

AI Summary (English)

Let $N = pq$ be the product of two balanced primes. In 2023, Cotan and Teșeleleanu introduced a novel family of RSA-like cryptosystems governed by the key equation $ed - k(p^n - 1)(q^n - 1) = 1$ for $n \geq 1$. This framework elegantly generalizes the classical RSA scheme ($n=1$) as well as the specific variant proposed by Elkamchouchi et al. ($n=2$). In this paper, we propose a novel generalized Wiener-type cryptanalytic attack specifically targeting the case where $n = 2^i$ with $i > 2$ being an integer. By ingeniously combining classical continued fraction algorithms with advanced lattice-based reduction techniques, our proposed method successfully recovers the private key under these specific conditions. This research serves as a natural and significant extension of previous cryptanalyses conducted for $n = 1, 2, 4$, thereby providing a comprehensive security boundary evaluation of this cryptosystem family and offering critical theoretical insights for future parameter selection in cryptographic design.

Abstract

Let $N = pq$ be the product of two balanced prime numbers $p$ and $q$. In 2023, Cotan and Te\c seleanu introduced a family of RSA-like cryptosystems based on the key equation $ed - k(p^n - 1)(q^n - 1) = 1$, where $n \geq 1$. Note that when $n = 1$, we obtain the classical RSA scheme, while $n = 2$ yields the variant proposed by Elkamchouchi, Elshenawy, and Shaban. In this paper, we present a novel attack that combines continued fractions with lattice-based methods for the case $n = 2^i$, where $i > 2$ is an integer. This represents a natural continuation of previous research, which successfully applied similar techniques for $n = 1, 2, 4$.

Trapdoor Functions with Secure Key Leasing and Copy Protection

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1913

AI Summary (中文)

受量子不可克隆定理启发，安全密钥租赁和复制保护等具备不可克隆特性的量子密码学原语近年来备受关注。然而，作为公钥密码学基础原语的陷门函数（TDFs）在这些前沿领域尚未得到充分研究。本文率先开展了 TDFs 在安全密钥租赁和复制保护设定下的系统性研究。首先，本文引入了带安全密钥租赁的陷门函数（TDF-SKL） 的定义，支持量子陷门的安全租赁与删除。我们在有无域采样器的情况下分别对 TDF-SKL 进行了形式化，并基于 LWE 假设构造了无域采样器方案，同时基于标准 PKE 方案与提示伪随机生成器构造了有域采样器方案。其次，定义了带复制保护的陷门函数（TDF-CP），其求逆功能由量子陷门进行复制保护，并基于不可区分混淆（iO）和 LWE 假设，遵循最新的模块化框架建立了具体构造。最后，本文深入探讨了上述原语的实际应用。针对现有带安全密钥租赁的公钥加密（PKE-SKL）和单解密者加密（SDE）方案中存在的关键漏洞——即量子解密密钥在解密恶意选择的密文后可能会被破坏的问题，我们利用 TDF-SKL 和 TDF-CP 分别构造了具有鲁棒量子解密密钥的 PKE-SKL 和 SDE 方案，从根本上确保了量子密钥在解密任意密文后依然可重复使用。

AI Summary (English)

Inspired by the quantum no-cloning theorem, unclonable cryptographic primitives like secure key leasing and copy protection have gained significant attention, yet fundamental trapdoor functions (TDFs) remain underexplored in these contexts. This work initiates the study of TDFs in these settings by formally defining TDFs with secure key leasing (TDF-SKL) and TDFs with copy protection (TDF-CP), providing concrete constructions based on the LWE assumption, standard PKE schemes, and indistinguishability obfuscation. Furthermore, we address a critical vulnerability in existing public-key encryption with secure key leasing (PKE-SKL) and single-decryptor encryption (SDE) schemes—where quantum decryption keys are destroyed after processing malicious ciphertexts. By leveraging our TDF-SKL and TDF-CP frameworks, we construct robust PKE-SKL and SDE schemes that guarantee the reusability of quantum decryption keys even after decrypting arbitrary ciphertexts.

Abstract

Inspired by the no-cloning theorem in quantum theory, a variety of quantum cryptographic primitives with unclonable functionalities, such as secure key leasing and copy protection, have been proposed and attracted significant attention. However, trapdoor functions (TDFs), fundamental primitives in public-key cryptography, have not been extensively studied in these areas. In this work, we initiate a study of TDFs in both secure key leasing and copy protection settings. We first introduce the definition of TDFs with secure key leasing (TDF-SKL), which enables leasing and deleting of quantum trapdoors. We formalize TDF-SKL both with and without domain sampler, and give a construction of TDF-SKL without domain sampler based on the LWE assumption and a construction of TDF-SKL with domain sampler based on any standard PKE schemes combined with hinting pseudorandom generators [Koppula and Waters, CRYPTO 2019]. Next, we define TDFs with copy protection (TDF-CP), where the inversion functionality is copy protected by a quantum trapdoor. We establish a construction of TDF-CP assuming indistinguishability obfuscation and the LWE assumption, following a modular framework of copy protection proposed by Ananth and Behera [CRYPTO 2024]. We also present applications of TDF-SKL and TDF-CP. Existing constructions of public-key encryption with secure key leasing (PKE-SKL) and single-decryptor encryption (SDE) suffer from a critical vulnerability: quantum decryption keys may be destroyed after decrypting maliciously chosen ciphertexts. We construct PKE-SKL schemes and SDE schemes with robust quantum decryption keys that remain reusable after decrypting arbitrary ciphertexts from TDF-SKL and TDF-CP, respectively.

Secrecy in Squirrel and the Post-Compromise Security of a Ratchet

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1912

AI Summary (中文)

研究背景：棘轮（Ratchet）协议是Signal、WhatsApp和苹果iMessage PQ3等众多安全消息应用中部署的关键密码学协议，旨在提供强大的安全保证，如后妥协安全性（Post-Compromise Security, PCS）。尽管计算机辅助密码学技术能提升对安全协议的信心，但由于涉及的密码学论证极为复杂，迄今为止，仍无法在计算模型下通过机械化方法证明棘轮协议的PCS，现有的机械化PCS分析均局限于符号模型。

研究方法：本研究采用Squirrel工具来攻克这一难题，该工具非常适合分析此类有状态协议。然而，由于推理过程错综复杂，加之Squirrel对保密性（secrecy）的间接建模难以扩展至如此复杂的证明，研究面临巨大挑战。

创新与发现：为解决上述问题，我们在Squirrel中开发了一种全新的逻辑框架，首次允许将“保密性”作为一等概念（first-class notion）进行直接推理。我们利用该框架成功验证了非对称棘轮协议的后妥协安全性。

主要结论：本研究实现了迄今为止首个针对棘轮协议（甚至可能是所有协议中首个）的PCS机械化计算证明，为安全消息协议的形式化验证树立了新的里程碑。

AI Summary (English)

Background & Challenge: Ratchet protocols are crucial for secure messaging applications aiming for Post-Compromise Security (PCS), yet mechanized computational proofs of PCS for ratchets have remained elusive due to highly complex cryptographic arguments, limiting existing analyses strictly to the symbolic model.

Method & Innovation: To tackle this challenge using the Squirrel tool, which is exceptionally well-suited for stateful protocols, we develop a novel logical framework that treats secrecy as a first-class notion. This innovation successfully overcomes the scalability issues of Squirrel's indirect secrecy modeling and the intricate reasoning traditionally required for such complex proofs.

Results: By applying this framework, we successfully verify the PCS of an asymmetric ratchet, yielding the first mechanized computational proof of PCS for a ratchet protocol to date. This breakthrough potentially extends to any cryptographic protocol, marking a significant milestone in the formal verification of secure messaging systems.

Abstract

Ratchets are critical cryptographic protocols deployed in many secure messaging applications such as Signal Messenger, WhatsApp, and Apple's iMessage PQ3, which aim for strong guarantees such as Post-Compromise Security (PCS). Computer-aided cryptography can be used to increase confidence in security protocols but, until now, has been unable to prove PCS in the computational model for a ratchet due to the complexity of the cryptographic arguments involved. Existing mechanized PCS analyses have been limited to the symbolic model.

We tackle this problem with Squirrel, which is well-suited to study such stateful protocols. The task is still a challenge, due to the intricate reasoning required, and because Sqirrel's indirect modeling of secrecy has difficulties in scaling to such a complex proof. To address these issues, we develop a novel logical framework in Squirrel that allows to reason on secrecy as a first-class notion, and we validate our approach by verifying the PCS of an asymmetric ratchet. This provides the first mechanized computational proof of PCS to date for a ratchet, and possibly for any protocol.

Why Johnny Should Not Delegate Email Encryption to Gateways

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1911

AI Summary (中文)

研究背景：基于 S/MIME 和 PGP 的电子邮件加密在企业环境中广泛部署，通常依赖集中式服务器端加密网关或本地网关来代表终端用户执行解密与签名，或为不支持加密的客户端提供加密支持。

研究方法：本文系统性地分析了四款主流加密网关产品（SEPPmail、CipherMail、Cisco Email Security Appliance 和 Proton Mail Bridge）的安全性，深入探讨了加密代理架构引入的隐患。

主要发现：研究共识别出 29 种攻击向量，允许攻击者完全解密邮件内容并混淆用户对邮件真实性的认知。研究者利用 S/MIME 的遗留密码学原语及 PGP 的向后兼容特性，将 EFAIL 等经典攻击适配至网关场景，并发现了由邮件基础设施错误信号引发的新型攻击路径。

核心结论：将密码学操作委托给网关会剥夺电子邮件客户端依赖的关键安全信号。这不仅使 EFAIL 等曾被视为已解决的攻击死灰复燃，还引入了安全状态通信中的可利用缺陷，并将敏感的解密明文暴露给未设计处理此类数据的中间基础设施。最终结论指出，将加密操作委托给网关从根本上破坏了 PGP 和 S/MIME 旨在提供的端到端安全模型。

AI Summary (English)

Background: Email encryption via S/MIME and PGP is widely deployed in enterprises, often relying on centralized or local gateways to handle cryptographic operations on behalf of end-users.

Methods & Findings: We systematically analyze the security of four such products: SEPPmail, CipherMail, Cisco Email Security Appliance, and Proton Mail Bridge. We identify 29 distinct attacks that allow adversaries to fully decrypt messages and spoof email authenticity. By exploiting legacy cryptographic primitives in S/MIME and backward compatibility features in PGP, we adapt known attacks like EFAIL to the gateway setting and expose novel vectors leveraging error signals from email infrastructure.

Conclusion: Our findings demonstrate that delegating cryptographic operations to gateways strips crucial security signals relied upon by email clients. This re-enables previously mitigated attacks like EFAIL, introduces exploitable flaws in security status communication, and exposes sensitive decrypted plaintext to intermediate infrastructure. Ultimately, we conclude that gateway-based delegation fundamentally undermines the end-to-end security model intended by PGP and S/MIME.

Abstract

Email encryption based on S/MIME and, to a lesser extent, PGP is widely deployed in enterprise environments, often through centralised server-side encryption gateways that decrypt and sign messages on behalf of end users. Gateways can also be run locally to implement encryption for email clients that do not natively support it.

We systematically analyse the security of four such products: SEPPmail, CipherMail, Cisco Email Security Appliance, and the Proton Mail Bridge. We identify 29 attacks which allow an adversary to fully decrypt messages and confuse users on the authenticity of received emails. To this end, we exploit the legacy cryptographic primitives in S/MIME and the backwards compatibility features for PGP, adapt well-known attacks such as EFAIL (Poddebniak et al., USENIX Security 2018) to this setting, and expose novel attack vectors such as the error signals produced by email infrastructure.

Our findings show that moving cryptographic operations to gateways strips important signals that email clients rely on. This re-enables attacks like EFAIL, which were largely considered resolved, and introduces exploitable features in how the security status of emails is communicated. Such systems also expose sensitive decrypted plaintext to intermediate email infrastructure, which was not designed to handle it. We conclude that delegating cryptographic operations to a gateway undermines the end-to-end security model that PGP and S/MIME were designed to provide.

NTPIR: Efficient Silent-Preprocessing PIR using NTR

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1910

AI Summary (中文)

隐私信息检索（PIR）允许客户端在不泄露查询索引的情况下检索数据库。在静默预处理模型中，现有协议多采用基于LWE的首层检索与基于RLWE的环打包及二层同态检索的两层架构，其中环打包是主要性能瓶颈。尽管NTRU支持所需的同态操作且密文仅由单个环元素表示，具备替代RLWE实现更紧凑中间表示的潜力，但其缺乏RLWE的公共随机性组件，难以直接应用于现有PIR方案的离线/在线分离。

为此，本文提出 NTPIR，通过三项核心技术解决该挑战：
1. 先打包后切换（Pack-then-switch）：在RLWE域完成环打包后，通过单次密钥切换转换为NTRU，在保留离线预处理结构的同时生成紧凑的单元素中间结果。
2. 分裂点选择（Split-point picking）：将二层列选择与响应打包相融合，将自同构复杂度从线性降至平方根级别。
3. 优化算术（Optimized arithmetic）：采用基于FFT的多项式乘法与近似小工具分解，提升同态运算效率，且正确性误差严格控制在 $2^{-40}$ 以内。

实验表明，在1至8GB的数据库上，NTPIR的服务器端在线速度较 InsPIRe$^{(2)}$ 提升达 $1.81\times$；在8GB规模下，预处理速度提升 $7$--$41\times$。在最高吞吐量配置下，NTPIR在8GB数据库上达到 8,609MB/s 的处理速度，分别比 InsPIRe$^{(2)}$、SimpleYPIR 和 HintlessPIR 快 $1.38\times$、$1.8\times$ 和 $2.0\times$。

AI Summary (English)

NTPIR addresses the ring-packing bottleneck in silent-preprocessing Private Information Retrieval (PIR) by leveraging NTRU's compact single-element ciphertexts. To overcome NTRU's lack of public randomness for offline/online separation, we introduce three techniques: (1) Pack-then-switch, performing ring packing in RLWE and converting to NTRU via a single key switch; (2) Split-point picking, integrating second-layer column selection with response packing to reduce automorphism complexity from linear to square-root; and (3) Optimized arithmetic, utilizing FFT-based polynomial multiplication and approximate gadget decomposition to ensure high efficiency with an error bound of $2^{-40}$. Evaluations on 1-8GB databases show that NTPIR achieves up to a $1.81\times$ online speedup and $7$--$41\times$ faster preprocessing over InsPIRe$^{(2)}$. At peak throughput, it sustains 8,609MB/s, outperforming InsPIRe$^{(2)}$, SimpleYPIR, and HintlessPIR by up to $2.0\times$.

Abstract

Private Information Retrieval (PIR) enables a client to query a database without revealing the requested index. In the silent preprocessing model, existing protocols typically adopt a two-layer pipeline: a first-layer retrieval based on LWE, followed by an RLWE ring-packing stage and a second-layer homomorphic column retrieval, with ring packing being the primary performance bottleneck. We observe that NTRU supports the homomorphic operations required by this pipeline while representing each ciphertext with a single ring element, suggesting its potential to replace RLWE for a more compact intermediate representation. However, NTRU lacks RLWE's public randomness component, which is required in the offline/online separation of most existing PIR schemes.

We introduce NTPIR to address this challenge through three techniques: (1) Pack-then-switch: we perform ring packing in the RLWE domain and transform the result to NTRU via a single key switch, preserving the offline preprocessing structure while yielding compact, single-element packed intermediates. (2) Split-point picking: this method integrates second-layer column selection with response packing, reducing automorphism complexity from linear to square-root complexity in the number of packed second-layer inputs. (3) Optimized arithmetic: we employ FFT-based polynomial multiplication and approximate gadget decomposition to improve the computational efficiency of the underlying homomorphic operations, with concrete correctness error at most $2^{-40}$.

On databases ranging from 1 to 8GB, NTPIR achieves up to a $1.81\times$ server-side online speedup over InsPIRe$^{(2)}$ (S&P'26). At 8\,GB, preprocessing step is $7$--$41\times$ faster than InsPIRe$^{(2)}$. In addition, at the highest-throughput configuration, NTPIR sustains 8,609MB/s on an 8GB database, corresponding to a $1.38\times$ speedup over InsPIRe$^{(2)}$, $1.8\times$ over SimpleYPIR, and $2.0\times$ over HintlessPIR.

Tightly and Adaptively Secure Two-Round Threshold Signatures from DDH

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1909

AI Summary (中文)

门限签名允许 $n$ 个参与方在单一公钥下联合生成签名，其中至少 $t+1$ 个参与方可以产生有效签名，而最多 $t$ 个参与方的联盟则无法做到。作为分布式信任的基础原语，门限签名被广泛应用于证书颁发机构、区块链和多方钱包等系统中。现代实际应用对门限签名提出了严格的安全性与效率要求，包括在现实对抗模型下的强安全保证（如抵抗自适应腐败、实现紧安全归约）以及极低的交互复杂度（即最少的通信轮数）。

尽管近期研究已在无配对群中实现了具备紧自适应安全性的三轮交互门限签名方案，但在标准的非交互困难假设下，能否同时实现紧安全性、自适应安全性以及两轮签名交互，仍是一个悬而未决的核心问题。

本文圆满解决了这一难题，提出了 TZAR 方案。这是首个在无配对循环群中，基于标准决策性 Diffie-Hellman (DDH) 假设实现紧且自适应安全的两轮门限签名方案。我们的构造不仅能够抵御最多 $t < n$ 个参与方被自适应腐败的攻击，还实现了仅有常数因子损失的安全紧归约。综上所述，TZAR 方案提供了强大的可证明安全保证，并将签名交互轮数降至最低的两轮，为延迟敏感的分布式环境带来了显著的性能优势。

AI Summary (English)

Threshold signatures are fundamental primitives for distributed trust, widely deployed in modern systems like blockchains and multiparty wallets. While recent progress has yielded three-round schemes with tight adaptive security in pairing-free groups, achieving tight security, adaptive security, and two-round signing simultaneously under a standard, non-interactive hardness assumption has remained a central open question. In this work, we resolve this challenge by introducing TZAR, the first two-round threshold signature scheme that is tightly and adaptively secure under the standard decisional Diffie-Hellman (DDH) assumption in pairing-free cyclic groups. Our construction achieves full adaptive security against up to $t < n$ corruptions and admits a tight security reduction with only a constant-factor loss. By requiring only two signing rounds, TZAR not only provides strong provable security guarantees but also minimizes interaction complexity, offering a crucial advantage for latency-sensitive distributed environments. This breakthrough significantly advances the practical deployment of highly secure and efficient distributed cryptographic protocols.

Abstract

Threshold signatures enable a set of $n$ parties to jointly generate signatures under a single public key such that any subset of at least $t+1$ parties can produce a valid signature, whereas any coalition of at most $t$ parties cannot. They constitute a fundamental primitive for distributed trust and are widely deployed in systems such as certification authorities, blockchains, and multiparty wallets. Modern applications require strong security guarantees under realistic adversarial models, including resistance to adaptive corruptions, tight security reductions, and low interaction complexity—most notably, a minimal number of communication rounds. Recent progress has produced threshold signature schemes in pairing-free groups that achieve tight and adaptive security with three rounds of interaction. This leaves open the central question of whether one can simultaneously achieve tight security, adaptive security, and two-round signing under a standard, non-interactive hardness assumption.

In this work, we resolve this question by presenting TZAR, the first two-round threshold signature scheme that is tightly and adaptively secure under the standard decisional Diffie-Hellman (DDH) assumption in pairing-free cyclic groups. Our construction achieves full adaptive security against up to $t < n$ corruptions and admits a tight security reduction with only constant-factor loss. Consequently, TZAR provides strong provable security guarantees and minimizes interaction by requiring only two signing rounds, an important advantage for latency-sensitive distributed environments.

Higher-order differential attacks on the full DuX

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1907

AI Summary (中文)

背景：DuX是一族定义在 $\mathbb{F}_q^{16}$ 上的替换-置换分组密码（$q\in\{2^{8},2^{16},65537\}$），包含12轮迭代。设计者评估认为，在加密方向上，积分与高阶差分区分器最多只能达到6轮。

方法：本文通过解密方向上的指数集来界定DuX的逐字代数度。研究发现，解密S盒的坐标度为(2,3,4,2)，与加密S盒的(5,3,2,8)不同。逆扩散矩阵的每一行仅支持模4字索引的两个剩余类。通过选择等于单一剩余类的活跃集，可使每层各类内的度界向量保持恒定。

发现与创新：我们证明了四类度界服从基数为 $2+\sqrt{3}$ 的精确递推关系（而非4）。基于此，我们构造了针对 DuX($2^{16}$) 和 DuX($65537$) 11轮以及 DuX($2^{8}$) 7轮的高阶差分区分器。向明文方向延伸一轮后，构建三个连续方程组，并利用双变量插值等技术进行求解。当方程组达到结构允许的最大秩时，即可恢复完整12轮 DuX($2^{16}$) 和 DuX($65537$) 的全部16个主密钥字。

结果：该攻击的数据与时间复杂度分别为 $2^{67.32}$ 和 $2^{67.58}$，且内存消耗为常数；对 DuX($2^{8}$) 可覆盖8轮，复杂度为 $2^{91.32}$。此外，由于两种扩散层仅相差4个字的旋转，本分析对 $2^{11}$ 种依赖密钥的扩散层选择均完全适用。

AI Summary (English)

DuX is a family of 12-round substitution-permutation block ciphers over $\mathbb{F}_q^{16}$, whose designers estimated that higher-order differential distinguishers in the encryption direction reach at most six rounds. By bounding the word-wise algebraic degree via exponent sets in the decryption direction, we reveal that an active set equal to one residue class modulo four maintains constant degree bounds per layer, which follow an exact recursion with base $2+\sqrt{3}$. This yields 11-round distinguishers for DuX($2^{16}$) and DuX($65537$), and extending one round towards the plaintext generates three successive equation systems that recover all 16 master-key words of the full 12-round ciphers with data and time complexities of $2^{67.32}$ and $2^{67.58}$. Furthermore, the analysis seamlessly applies to all $2^{11}$ key-dependent diffusion layer choices and covers eight rounds of DuX($2^{8}$) with a complexity of $2^{91.32}$.

Abstract

DuX is a family of substitution-permutation block ciphers over $\mathbb{F}_q^{16}$ with $q\in\{2^{8},2^{16},65537\}$ and twelve rounds. For the two large-word instances its designers estimate that integral and higher-order differential distinguishers in the encryption direction reach at most six rounds, and fix the number of rounds accordingly. We bound the word-wise algebraic degree of DuX by exponent sets in the decryption direction, where the decryption S-box has coordinate degrees $(2,3,4,2)$ against the $(5,3,2,8)$ of the encryption S-box. Each row of the inverse diffusion matrix is supported on two residue classes of word indices modulo four. An active set equal to one class therefore keeps the vector of degree bounds constant within each class at every layer, and we prove that the four class-wise bounds then obey an exact recursion with base $2+\sqrt{3}$ instead of four. This yields higher-order differential distinguishers for eleven rounds of DuX($2^{16}$) and DuX($65537$) with $q^{4}$ chosen ciphertexts, and for seven rounds of DuX($2^{8}$) with $2^{88}$. Extending one round towards the plaintext gives three successive systems of equations. Every unknown there has a coefficient computed from the returned plaintext words, and the key words recovered at one stage are substituted into the next; for DuX($65537$) the last two systems are replaced by bivariate interpolation. Once each system attains the maximal rank that its structure permits, a condition that can be checked during the attack, solving the systems recovers all sixteen master-key words of the full twelve-round DuX($2^{16}$) and DuX($65537$). The data and time complexity is $2^{67.32}$ and $2^{67.58}$ with constant memory, and eight rounds of DuX($2^{8}$) are covered with $2^{91.32}$. The two diffusion layers differ by a rotation of four words, so the analysis is the same for each of the $2^{11}$ key-dependent choices of diffusion layers.

Revisiting Simple Power Analysis of Polynomial Multiplication in the HQC Implementation

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1906

AI Summary (中文)

背景与动机：汉明准循环（HQC）方案是近期被美国国家标准与技术研究院（NIST）选定的后量子密钥封装机制标准化算法，其具体实现的侧信道安全性至关重要。先前的研究已证明可通过简单功耗分析（SPA）攻击基于查找表的多项式乘法，为此，最新的 HQC 参考实现将乘法例程替换为按位学校乘法（bitwise schoolbook multiplication），试图抵御此类攻击。

主要发现：本文重新审视了最新 HQC 参考实现的侧信道抗性。研究发现，尽管进行了上述修改，更新后的 schoolbook_mul 函数在解密过程中的功耗消耗依然呈现出清晰且视觉上可区分的差异，且这些差异直接依赖于秘密数据。利用这些功耗模式，攻击者能够成功恢复秘密多项式的各个比特。这有力地证明了简单功耗分析（SPA）对更新后的 HQC 设计依然有效。

创新与贡献：为了解决这一安全漏洞，本文深入分析了潜在的防御对策，并创新性地提出了一种零成本的缓解方案。该方案通过交换操作数的角色，使得掩码计算过程仅依赖于公开数据。这一改进不仅彻底消除了由秘密数据依赖的控制流引起的直接信息泄漏，而且完美保持了原有的计算性能，为 HQC 的安全部署提供了重要保障。

AI Summary (English)

The Hamming Quasi-Cyclic (HQC) scheme, recently selected by NIST for post-quantum standardization, requires rigorous security evaluations of its implementations against side-channel attacks. Although the latest HQC reference implementation replaced lookup-table-based multiplication with bitwise schoolbook multiplication to mitigate prior Simple Power Analysis (SPA) vulnerabilities, our analysis reveals that the updated schoolbook_mul routine still exhibits visually distinguishable, secret-dependent power consumption variations during decryption. Exploiting these leakage patterns allows attackers to successfully recover individual bits of the secret polynomial, demonstrating that SPA remains highly effective against the updated design. To address this critical vulnerability, we propose a novel zero-cost mitigation strategy that swaps operand roles to ensure mask computation depends solely on public data. This approach effectively eliminates direct information leakage caused by secret-dependent control flow while strictly preserving the original computational performance, providing a practical countermeasure for secure HQC deployment.

Abstract

The Hamming Quasi-Cyclic (HQC) scheme is a post-quantum key encapsulation mechanism recently selected for standardization by NIST, making the security of its implementations a critical concern. In this work, we revisit the side-channel resistance of the latest HQC reference implementation, with a focus on its polynomial multiplication routine used in decryption. While prior work demonstrated a simple power analysis (SPA) attack against a lookup-table-based multiplication, the updated implementation replaces this with a bitwise schoolbook multiplication.

Despite these modifications, we show that the updated function schoolbook_mul still shows clear, visually distinguishable variations in power consumption that depend on secret data. Using these patterns, an attacker can recover individual bits of the secret polynomial, demonstrating that SPA remains effective against the updated design. To address this vulnerability, we analyze potential countermeasures and propose a zero-cost mitigation based on swapping operand roles so that the mask computation depends only on public data. This eliminates direct leakage of secret-dependent control flow while preserving performance.

A Better Bivariate Resultant Attack on Round-Reduced Poseidon

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1905

AI Summary (中文)

研究背景

Poseidon 是一种极具代表性的面向算术化（Arithmetization-oriented, AO）哈希函数，因其卓越的评估性能而在零知识证明协议（如 Plonky3 和以太坊协议）中得到广泛应用。AO 哈希函数的安全性通常通过 CICO-k 问题来评估，即同时控制置换函数输入和输出的 k 个坐标。本文聚焦于与以太坊基金会赏金计划密切相关的 CICO-2 问题。

方法与挑战

CICO-2 问题可被建模为一个双变量多项式系统 $P(X, Y) = Q(X, Y) = 0$，其总次数为 $\delta = d^{R_F + R_P}$。求解此类系统的最佳已知方法是双变量结式（bivariate resultant）算法。对于一般系统，最优算法的渐近位复杂度与 $\delta^{2+\epsilon}$ 呈线性关系。然而，Poseidon 衍生的多项式系统具有高度的结构化特征，导致其结式次数 $D_I = d^{2R_F + R_P}$ 远低于同等总次数随机系统的预期。先前的研究已利用这一特性，通过评估-插值方法在准线性时间 $d^{3R_F + 2R_P}$ 内计算结式。

创新点与主要发现

本文针对结式次数远低于 $\delta^2$ 的特殊结构，提出了一种改进的双变量结式攻击算法。通过对具有此类特性的系统进行深入分析，我们证明了在合理的启发式假设下，Poseidon 的 CICO-2 问题可以在关于 $D_I \delta^{1-1/\omega}$ 的准线性时间内求解，其中 $2 \le \omega < 2.38$ 为矩阵乘法指数。我们在轮数缩减的 Poseidon 置换函数上实现了该攻击，实验结果不仅验证了理论分析，还展示了相较于现有最优方法显著的实际加速效果。

AI Summary (English)

The security of the Poseidon hash function, widely utilized in zero-knowledge proofs, is commonly evaluated through the CICO-2 problem, which can be modeled as a bivariate polynomial system with total degree $\delta$. While generic bivariate resultant algorithms require time quasi-linear in $\delta^2$, the highly structured nature of Poseidon yields a resultant degree $D_I$ significantly lower than the generic expectation. In this work, we propose an improved bivariate resultant attack specifically tailored to exploit this exceptionally low-degree resultant property. Under standard heuristics, we demonstrate that the CICO-2 problem on Poseidon can be solved in time quasi-linear in $D_I \delta^{1-1/\omega}$, where $2 \le \omega < 2.38$ is the matrix multiplication exponent. We validate our theoretical findings by implementing the attack on round-reduced Poseidon instances, demonstrating a substantial practical speedup and breaking new ground compared to previous evaluation-interpolation approaches.

Abstract

Poseidon is one of the most popular arithmetization-oriented (AO) hash function, due to its good performances both in evaluation and in Zero-knowledge proof protocols. It is for instance used in the Plonky3 library, and has been considered for use in the Ethereum protocol.

The security of Arithmetization-oriented hash functions is commonly evaluated through the CICO-k problem, which consists in controlling simultaneously k coordinates in the input and output of the permutation. This problem is in particular relevant to finding preimages in sponge or compression mode and solving zero-test problems. Depending on the size of the underlying field, different values of k may be relevant. In this paper, we focus on the case of k=2, that was the subject of the recent bounty program by the Ethereum foundation.

In this setting, one can model the CICO-2 problem as a bivariate system P(X, Y) = Q(X, Y) = 0 where the polynomials have total degree delta = d^(RF +RP). The best known methods for solving bivariate systems are algorithms for computing bivariate resultants. Over a generic system with coefficients over a finite field, the best algorithms achieve an asymptotic bit complexity that is linear in delta^(2+eps) log(q)^(1+eps), which is close to optimal, given that the input and output of the algorithm have bit size delta^2 log (q).

However, the polynomial systems that stem from Poseidon are more structured, leading to a resultant that has degree DI = d^(2RF + RP), which is much less than what one would expect from a random bivariate system of degree d^(RF + RP). This fact has already been exploited in a previous work that used an evaluation-interpolation approach to compute the bivariate resultant in time that is quasi-linear in d^(3 RF + 2 RP).

In this work, we exploit this fact by adapting another bivariate resultant algorithm to the special setting where the degree of the resultant of the equations is much lower than delta^2. By doing a careful analysis of the algorithm for systems with such property, we show that under some heuristics, the CICO-2 problem on Poseidon can be solved in time that is quasi-linear in DI delta^(1-1/w), where 2 <= w < 2.38 is the exponent of matrix multiplication. We validate our approach by implementing our attack on reduced versions of the Poseidon permutation, and show a practical speedup compared to the previous approaches.

When Module Lattice Leaks: Horizontal Fusion Attacks on ML-DSA Implementation

Mon, 07 Sep 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1904

AI Summary (中文)

研究背景：随着ML-DSA标准化的推进，其实用安全性成为密码学界关注的焦点。传统观点普遍认为，尽管分析攻击仅需少量轨迹，但非分析侧信道攻击通常需要庞大的轨迹复杂度。

核心创新：本文提出了一种全新的“水平融合攻击”（Horizontal Fusion Attacks），成功打破了这一假设，证明了对ML-DSA（甚至掩码实现）进行非分析、少轨迹的密钥恢复具有高度实用性。

漏洞揭示：研究从侧信道视角暴露了模块格（module lattice）的结构性漏洞。在矩阵向量乘法中，临时秘密向量 $\hat{\mathbf{y}}$ 的行级重用特性导致单次签名生成会暴露 $k$ 个相同秘密依赖中间值的泄漏实例，且每个实例具有不同且已知的系数。

关键技术：为克服噪声和编译器优化带来的实际利用难题，本文提出了基于方差的加权融合策略，根据领先候选与次优候选的分离度进行动态加权，并利用签名关系提取私钥的有符号系数。同时，引入了基于INTT的快速代数筛，大幅提升了密钥恢复的成功率。

实验结果：实验表明，仅需 4条轨迹 即可对最高安全参数集 ML-DSA-87 实现完整的非分析相关分析密钥恢复；针对最先进的一阶掩码实现，也仅需不超过 90条轨迹 即可提取私钥。该成果刷新了非分析攻击的轨迹复杂度纪录，其表现足以媲美传统的分析攻击。

AI Summary (English)

While profiling side-channel attacks on ML-DSA are well-studied, non-profiling attacks are traditionally assumed to demand large trace complexity. We challenge this assumption by introducing horizontal fusion attacks, demonstrating that non-profiling, few-trace key recovery is highly practical even against masked implementations. Specifically, we expose a structural vulnerability in the module lattice where the row-wise reuse of the ephemeral secret vector exposes multiple leakage instances of the same intermediate value during a single signature generation. To overcome practical hurdles like noise, we propose a variance-based weighted fusion strategy and a fast INTT-based algebraic sieve to efficiently extract the secret key. Our non-profiling correlation analysis achieves full key recovery on the highest security parameter set (ML-DSA-87) using merely 4 traces, and extracts the secret key from state-of-the-art first-order masked implementations with no more than 90 traces. These results establish new records in trace complexity for both unprotected and masked ML-DSA, performing comparably to profiling-based attacks.

Abstract

The standardization of ML-DSA has shifted the cryptographic community's focus toward its practical security. While profiled attacks against its implementations are well studied with a few traces, non-profiling attacks are widely assumed to require large trace complexity. We challenge this by introducing horizontal fusion attacks, demonstrating that non-profiling, few-trace key recovery is highly practical against ML-DSA, even against masked implementations.

We expose a structural vulnerability in the module lattice from a side-channel perspective. In particular, in ML-DSA's matrix-vector multiplication ($\hat{\mathbf{A}} \circ \hat{\mathbf{y}}$), the row-wise reuse of the ephemeral secret vector $\hat{\mathbf{y}}$ indicates that one single signature generation exposes $k$ (the row-wise size of $\hat{\mathbf{A}}$) leakage instances of the same secret-dependent intermediate value, each with a distinct and known coefficient of $\hat{\mathbf{A}}$. However, exploiting this in practice is highly non-trivial due to noise and/or compiler optimizations. To overcome this, we propose a variance-based weighted fusion strategy. This approach weights each operation by how far its leading candidate is separated from the runner-up candidates, and the signing relation ($\mathbf{y} = \mathbf{z} - c \cdot \mathbf{s}_1$) lets us extract the signed coefficients of the secret key. Moreover, we introduce a fast, INTT-based algebraic sieve that further increases the success rate of key recovery.

Putting together, we achieve full key recovery using merely 4 traces against ML-DSA-87 (the highest security parameter set) with non-profiling correlation analysis. On the state-of-the-art first-order masked ML-DSA implementation, our attack extracts the secret key using no more than 90 traces. To the best of our knowledge, these non-profiling results establish a new record in trace complexity for both unprotected and first-order masked ML-DSA implementations, even comparable to these profiling-based attacks.

A Queryable Graph-Based Security Analysis Framework for O-RAN

Sun, 06 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06855

AI Summary (中文)

背景：开放无线接入网（O-RAN）通过模块化和可互操作的架构取代了传统供应商锁定的RAN，极大促进了行业竞争与创新。然而，这种开放性也带来了系统复杂性的增加和攻击面的扩大，使安全问题成为重中之重。当前，评估O-RAN的安全性依赖于人工交叉比对数十项技术规范、厂商白皮书及学术研究，该过程不仅耗时费力、易出错，且结果呈静态化。

方法：为此，本文提出了一种基于图的安全分析框架，将上述静态语料库转化为单一的可查询数据库。该图数据库包含超过350个节点和1250余条关系，数据提炼自官方规范、学术论文、开源项目及漏洞数据库。为保持数据的时效性，我们集成了一套混合数据提取管道，将针对结构化规范的确定性解析与利用大语言模型（LLM）辅助提取动态规范及非结构化文献相结合。

发现：通过对该图数据库的查询分析，我们得出三项关键发现：首先，O-DU、SMO和O-Cloud等关键基础设施面临数十项规范级威胁，但缺乏实证层面的安全覆盖；其次，在分析的CVE相关CWE中，内存安全弱点占比超过一半（21次中出现11次）；最后，模糊测试技术发现了学术论文中归因的20个CVE中的18个。

创新：我们将该数据库、提取管道及查询代码作为开源工件发布，以推动O-RAN安全研究的自动化与规模化发展。

AI Summary (English)

The Open Radio Access Network (O-RAN) introduces significant security challenges due to its increased architectural complexity and expanded attack surface, while current security assessments rely on error-prone, manual cross-referencing of static documents. To address this limitation, we propose a queryable graph-based framework that transforms over 350 nodes and 1,250 relationships from diverse specifications, academic literature, and vulnerability databases into a unified, dynamically updated knowledge graph. This is achieved using a novel hybrid extraction pipeline that combines deterministic parsing for structured specifications with Large Language Model (LLM)-assisted extraction for evolving and unstructured texts. Querying this comprehensive graph reveals three critical insights: essential infrastructure components like O-DU, SMO, and O-Cloud face numerous specification-level threats yet suffer from minimal empirical security coverage; memory-safety weaknesses account for the majority of analyzed CWE occurrences; and fuzzing proves highly effective in uncovering research-attributed CVEs. Ultimately, we release the constructed database, the extraction pipeline, and the analytical queries as open-source artifacts to facilitate robust, scalable, and automated O-RAN security analysis.

Abstract

The Open Radio Access Network (O-RAN) replaces vendor-locked RANs with a modular and interoperable architecture that fosters competition and accelerates innovation. With this openness comes increased complexity and a larger attack surface, making security a critical concern. Today, assessing O-RAN security requires manually cross-referencing dozens of specifications, vendor whitepapers, and academic studies, which is error-prone and static. In this paper, we present a graph-based framework that transforms this static corpus into a single, queryable database. Our graph representation contains over 350 nodes and more than 1,250 relationships, distilled from specifications, academic papers, open-source projects, and vulnerability databases. To keep this resource current, we integrate a hybrid data extraction pipeline that couples deterministic parsing of structured specifications with Large Language Model (LLM)-assisted extraction for evolving specifications and unstructured literature. Querying the graph reveals three actionable findings within our curated corpus: critical infrastructure such as the O-DU, SMO, and O-Cloud carries dozens of specification-level threats yet has little or no empirical coverage; memory-safety weaknesses account for 11 of the 21 CWE occurrences associated with the analyzed CVEs; and fuzzing uncovered 18 of the 20 CVEs attributed to research papers. We provide the database, pipeline, and queries as open-source artifacts.

WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic

Sun, 06 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06840

AI Summary (中文)

研究背景：Web应用防火墙（WAF）主要依赖签名来检测已知攻击，难以应对未知或变体负载。正向安全通过学习合法流量并拦截超出配置文件的输入来提供补充，但直接从实时流量学习存在被恶意请求污染训练数据的安全风险。

核心方法：本文提出了白名单自主策略生成器（WAPP）框架。该框架创新性地结合了信任过滤、确定性规则合成、置信度评分以及执行前验证机制，旨在从实时流量中安全、自动地学习正向安全WAF策略。

实验与发现：研究在三个受控应用上基于Coraza和OWASP CRS栈进行了评估。结果表明，在DVWA用户名字段中，未过滤的学习在0.2%污染流量下性能降级，0.5%时完全失效；而自由文本字段即使无污染也会放行恶意输入。在抗污染测试中，WAPP结合全部7种候选信号的消融配置将抗污染韧性从53%大幅提升至90%，显著优于Kruegel-Vigna基线的62%。

创新与结论：WAPP的确定性合成器实现了与语言模型相当的拦截效果，且无需承担模型推理成本。该框架成功拦截了受限字段上的CRS绕过攻击，但指出自由文本输入仍是一个精度挑战，需要字符级的操作符控制。WAPP为从实时流量中安全学习WAF策略提供了一种高效、鲁棒的解决方案。

AI Summary (English)

Web Application Firewalls (WAFs) utilizing positive security learn legitimate traffic patterns to block anomalies, yet direct learning from live traffic remains vulnerable to malicious data poisoning. This paper introduces the Whitelisting Autonomous Policy Producer (WAPP), a novel framework designed for safe policy learning by integrating trust filtering, deterministic rule synthesis, confidence scoring, and pre-enforcement validation. Evaluated on a live Coraza and OWASP CRS stack across controlled applications, WAPP demonstrates robust resilience against data poisoning. Specifically, incorporating seven candidate signals significantly improves poisoning tolerance from 53% to 90%, substantially outperforming the Kruegel-Vigna baseline of 62%. Furthermore, the deterministic synthesizer achieves attack blocking performance comparable to tested language models without incurring inference costs. While WAPP successfully mitigates confirmed CRS bypasses on constrained fields, the study highlights that free-text inputs remain a precision challenge necessitating character-level operator control.

Abstract

Web Application Firewalls (WAFs) mainly rely on signatures to detect known attacks, which can leave gaps against modified or previously unseen payloads. Positive security provides a complementary approach by learning legitimate traffic and blocking inputs that fall outside the learned profile. However, learning directly from live traffic can be unsafe when malicious requests contaminate the training data. This paper presents the Whitelisting Autonomous Policy Producer (WAPP), a framework that combines trust filtering, deterministic rule synthesis, confidence scoring, and validation before enforcement. WAPP is evaluated on three controlled applications using a live Coraza and OWASP Core Rule Set (CRS) stack. Results show that, on the tested DVWA username field, unfiltered learning becomes Degraded at 0.2\% poisoned traffic and Broken at 0.5%, while the evaluated free text field can admit malicious inputs even without poisoning. On the frozen poisoning dataset, the ablation configuration with all seven candidate signals improves the measured poisoning resilience from 53% to 90%, compared with 62% for the Kruegel--Vigna baseline. The deterministic synthesizer provides attack blocking comparable to the tested language model without model inference cost. WAPP blocks confirmed CRS bypasses on constrained fields, while free text inputs remain a precision challenge that requires character level operator control.

MechAudit-40: White-Box Auditing across 40 LLM Attack Mechanisms

Sun, 06 Sep 2026 00:00:00 +0000

Paper Link: https://arcxiv.org/abs/2609.06612

AI Summary (中文)

背景：当前大语言模型（LLM）面临的攻击手段繁多，但现有的白盒防御评估通常局限于单一或孤立的攻击类型。异构攻击是否会在模型内部表示中留下能够泛化至未知威胁机制的特征偏移，仍是未解之谜。

方法：本文提出 MechAudit-40，在五种开放权重模型架构上对 40 种攻击机制进行系统性评估。研究构建了包含 10 万个匹配“干净-攻击”表示对的数据集，并结合预定义类别与分组留出集，有效隔离了真实的攻击诱导位移与目标规模、语料偏差及数据泄漏等干扰因素。

主要发现：研究表明，攻击会在模型内部引发结构化的多层深度轨迹，而非孤立的层激活峰值。虽然原始峰值在不同架构间缺乏可移植性，但经过目标校准的特征分布保留了可迁移的几何签名。在完全机制留出实验中，仅凭隐藏状态即可达到 82.5% 的威胁类别识别准确率。

创新点：基于上述发现，我们设计了 MechAudit 运行时审计器。该审计器在严格的无先验（zero-oracle）约束下运行，无需干净基线或攻击元数据。实验显示，MechAudit 在 0.70% 的极低误报率下实现了 81.1% 的留出攻击检测率，且在整体功能类别被隐藏时仍保持 78.1% 的召回率。它是唯一在所有 40 种机制中避免覆盖率崩溃（召回率均超 50%）的检测器。这证明内部表示可有效支持跨机制的攻击暴露审计，且独立于下游任务受损与参数完整性。

AI Summary (English)

While white-box defenses for Large Language Models (LLMs) are typically evaluated on isolated attack families, it remains unknown whether heterogeneous attacks induce internal representation shifts generalizable to unseen mechanisms. To address this, we introduce MechAudit-40, a systematic evaluation of 40 attack mechanisms across five open-weight architectures, utilizing 100,000 matched clean-attack representation pairs to isolate genuine attack-induced displacements from confounding factors. Our findings reveal that attacks induce structured multi-depth trajectories, and target-calibrated profiles preserve transferable geometric signatures, enabling an 82.5% accuracy in categorizing unseen attacks using only hidden states. Building on this, we propose MechAudit, a zero-oracle runtime auditor that detects 81.1% of held-out attacks at a 0.70% false-positive rate and uniquely avoids mechanism-level coverage collapse, maintaining over 50% recall across all 40 mechanisms. Ultimately, this work demonstrates that internal representations robustly support cross-mechanism attack-exposure auditing, decoupled from downstream task compromise and parameter integrity.

Abstract

While LLM attacks span prompt optimization, multi-turn context manipulation, retrieval poisoning, and model backdoors, white-box defenses are typically evaluated on isolated attack families. Consequently, whether heterogeneous attacks leave internal representation shifts that generalize to unseen threat mechanisms remains unknown. We present MechAudit-40, a systematic evaluation of 40 attack mechanisms across five open-weight model architectures. Threat-specific success criteria, 100,000 matched clean-attack representation pairs, predefined categories, and grouped holdouts isolate genuine attack-induced displacement from target scale, corpus bias, and data-leakage shortcuts. Across this testbed, attacks induce structured multi-depth trajectories rather than isolated layer spikes. While raw peaks are non-portable across architectures, target-calibrated profiles preserve transferable geometric signatures: under complete mechanism holdout, hidden states alone recover the threat category of unseen attacks with 82.5% accuracy. Guided by this finding, we design MechAudit, a runtime auditor that operates under strict zero-oracle constraints without requiring clean baseline traces or attack metadata. MechAudit detects 81.1% of held-out attack executions at a 0.70% false-positive rate and maintains 78.1% recall when an entire functional category is withheld. In matched comparisons, MechAudit is the only detector that avoids mechanism-level coverage collapse, maintaining over 50% recall across all 40 mechanisms. Internal representations thus support cross-mechanism attack-exposure auditing against calibrated benign references, but decouple from downstream task compromise and parameter integrity.