A Resource-Aware Behavior Reconstruction and Hierarchical Semantic Learning Framework for Host Intrusion Detection

System calls syscalls record key interactions between running programs and the operating system kernel, providing fine-grained and minimally intrusive data for host-based intrusion detection systems HIDS deployed in cloud and other modern computing environments. However, existing methods often...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-103270: Missing Authentication for Critical Function

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

Learning Normal Diffusion Dynamics for Backdoor Defense in Text-To-Image Models

Backdoor attacks pose a serious threat to the secure deployment of text-to-image T2I diffusion models. Existing defenses typically detect backdoors from specific abnormal patterns in internal representations, which may limit their generalizability with the emergence of increasingly diverse attack...

Compression Footprints As Security Signals for Model-Poisoning Defense in Federated Learning

Lossy compression is widely used in Federated Learning FL but is generally treated as an error source, while conventional poisoning defenses inspect update geometry. In this work, we instead treat the compressor's response as a security signal: the input-dependent distortion and payload behavior...

Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution

An autonomous cyber defender trained with reinforcement learning RL is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it...

Cybersecurity in Edge Computing: A Trust-Aware Federated Hybrid Intrusion Detection Framework

Edge computing has emerged as a critical computing paradigm in modern distributed systems by migrating data processing closer to end users and Internet of Things IoT devices. While this paradigm decentralizes processes, minimizes latency, and reduces backhaul bandwidth congestion, it exponentiall...

Forensic-Aware Continual Adaptation for Image Forgery Localization

The rapid evolution of image manipulation techniques has raised growing public security concerns. Existing Image Forgery Localization IFL methods can accurately localize manipulated regions but are often unable to adapt to newly emerging forgeries. In real-world forensic scenarios, data typically...

Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats

Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement. Latency attacks also energy-latency attacks increase inference-time work, energy, or response time, causing deadline misses, throughput collapse, or resource exhaustion in...

SecureVibe: Making Vibe Coding More Secure

As vibe coding becomes increasingly capable and widespread, security vulnerabilities in even functionally correct solutions are a growing concern. When investigating functionally correct but insecure solutions, we find that the insecure agent is less than half as likely to conduct effective...

Distillation Defenses Easily Break after Reinforcement Learning

Distillation attacks copy the reasoning capabilities of closed-source large language models, allowing bad actors to replicate state-of-the-art performance at low cost. Attackers systematically collect a large volume of frontier model reasoning traces and then train i.e., "distill" their own model...

DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning

Decentralized Federated Learning DFL eliminates the central aggregation server, reducing the single point of observation that traditional defenses against attacks rely on. As a result, peer-to-peer networks become exposed to malicious updates containing backdoors or semantic poisoning, since such...

Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure

Federated learning enables industrial operators to train shared intrusion detection models without disclosing proprietary operational telemetry. However, existing defenses operate strictly in update space, leaving aggregators blind to data poisoning; model updates derived from fabricated telemetr...

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis

Cyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces. This...

Climbing the Hill: Prompt Injection Red-Teaming against Frontier Models with Curriculum Reinforcement Learning

Prompt injection is a leading security risk for LLMs and LLM-based applications such as agents. State-of-the-art red-teaming methods for prompt injection leverage reinforcement learning RL to train an attacker LLM to generate effective injected prompts. However, when targeting frontier LLMs such ...

RAISE: Reinforcing Access Control Policy Synthesis in LLMs Via Symbolic Evaluation

Translating natural-language access-control requirements into policies requires careful reasoning about permissions, constraints, and exceptions, and even frontier LLMs often produce policies that violate the intended authorization semantics. We construct CedarInstruct, to our knowledge the first...

CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

Kibana Machine Learning Data Compromise

The vulnerability of the Machine Learning plugin of the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity of the protected information...

Context-Aware Functional Modeling for Android Third-Party Library Detection

Third-party libraries TPLs are widely used in Android apps, but their reuse can introduce security risks and interfere with downstream program analyses. Existing Android TPL detection approaches face two key limitations: their hand-crafted features are fragile under aggressive code transformation...

JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models

Models trained with reinforcement learning for calibrated decisions RLCD, such as Jev, answer a typed question about an input, the state, with a probability, a choice, or a score, and software acts on the answer without a person reading it. Their robustness has not been measured: adversarial...