QGuard:Question-Based Zero-Shot Guard for Multi-Modal LLM Safety

The recent advancements in Large Language ModelsLLMs have had a significant impact on a wide range of fields, from general domains to specialized areas. However, these advancements have also significantly increased the potential for malicious users to exploit harmful and jailbreak prompts for...

InfoFlood: Jailbreaking Large Language Models with Information Overload

Large Language Models LLMs have demonstrated remarkable capabilities across various domains. However, their potential to generate harmful responses has raised significant societal and regulatory concerns, especially when manipulated by adversarial techniques known as "jailbreak" attacks. Existing...

Privacy-Preserving Federated Learning against Malicious Clients Based on Verifiable Functional Encryption

Federated learning is a promising distributed learning paradigm that enables collaborative model training without exposing local client data, thereby protect data privacy. However, it also brings new threats and challenges. The advancement of model inversion attacks has rendered the plaintext...

Semantic Preprocessing for LLM-Based Malware Analysis

In a context of malware analysis, numerous approaches rely on Artificial Intelligence to handle a large volume of data. However, these techniques focus on data view images, sequences and not on an expert's view. Noticing this issue, we propose a preprocessing that focuses on expert knowledge to...

LLM Embedding-Based Attribution (LEA): Quantifying Source Contributions to Generative Model'S Response for Vulnerability Analysis

Security vulnerabilities are rapidly increasing in frequency and complexity, creating a shifting threat landscape that challenges cybersecurity defenses. Large Language Models LLMs have been widely adopted for cybersecurity threat analysis. When querying LLMs, dealing with new, unseen...

MAL-2025-5211 Malicious code in cro-pricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ad3153abfc5098f205551190f8a491deda5c4b47c00a18ed66800ef238c6b78d The OpenSSF Package Analysis project identified 'cro-pricing' @ 1.0.8 npm as malicious. It is considered malicious because: - The package...

An Efficient Construction of Raz's Two-Source Randomness Extractor with Improved Parameters

Randomness extractors are algorithms that distill weak random sources into near-perfect random numbers. Two-source extractors enable this distillation process by combining two independent weak random sources. Raz's extractor STOC '05 was the first to achieve this in a setting where one source has...

Efficient Retail Video Annotation: a Robust Key Frame Generation Approach for Product and Customer Interaction Analysis

Accurate video annotation plays a vital role in modern retail applications, including customer behavior analysis, product interaction detection, and in-store activity recognition. However, conventional annotation methods heavily rely on time-consuming manual labeling by human annotators,...

Understanding Content Moderation Policies and User Experiences in Generative AI Products

While recent research has focused on developing safeguards for generative AI GAI model-level content safety, little is known about how content moderation to prevent malicious content performs for end-users in real-world GAI products. To bridge this gap, we investigated content moderation policies...

Building Automotive Security on Internet Standards: an Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services

The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become...

LLM vs. SAST: a Technical Analysis on Detecting Coding Bugs of GPT4-Advanced Data Analysis

With the rapid advancements in Natural Language Processing NLP, large language models LLMs like GPT-4 have gained significant traction in diverse applications, including security vulnerability scanning. This paper investigates the efficacy of GPT-4 in identifying software vulnerabilities compared...

SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis

The integration of open-source third-party library dependencies in Java development introduces significant security risks when these libraries contain known vulnerabilities. Existing Software Composition Analysis SCA tools struggle to effectively detect vulnerable API usage from these libraries d...

AI Safety Vs. AI Security: Demystifying the Distinction and Boundaries

Artificial Intelligence AI is rapidly being integrated into critical systems across various domains, from healthcare to autonomous vehicles. While its integration brings immense benefits, it also introduces significant risks, including those arising from AI misuse. Within the discourse on managin...

Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers

Although Foundation Models FMs, such as GPT-4, are increasingly used in domains like finance and software engineering, reliance on textual interfaces limits these models' real-world interaction. To address this, FM providers introduced tool calling-triggering a proliferation of frameworks with...

deepSURF: Detecting Memory Safety Vulnerabilities in Rust through Fuzzing LLM-Augmented Harnesses

Although Rust ensures memory safety by default, it also permits the use of unsafe code, which can introduce memory safety vulnerabilities if misused. Unfortunately, existing tools for detecting memory bugs in Rust typically exhibit limited detection capabilities, inadequately handle Rust-specific...

Dual Protection Ring: User Profiling Via Differential Privacy and Service Dissemination through Private Information Retrieval

User profiling is crucial in providing personalised services, as it relies on analyzing user behaviour and preferences to deliver targeted services. This approach enhances user experience and promotes heightened engagement. Nevertheless, user profiling also gives rise to noteworthy privacy...

Buy It Now, Track Me Later: Attacking User Privacy Via Wi-Fi AP Online Auctions

Static and hard-coded layer-two network identifiers are well known to present security vulnerabilities and endanger user privacy. In this work, we introduce a new privacy attack against Wi-Fi access points listed on secondhand marketplaces. Specifically, we demonstrate the ability to remotely...

CVE-2025-38070

In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: Add NULL check in sma1307settingloaded All varibale allocated by kzalloc and devmkzalloc could be NULL. Multiple pointer checks and their cleanup are added. This issue is found by our static analysis tool...

chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Summary The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect. We consider this a lower-severity open redirect, as it can't be exploited from browsers or email clients requires manipulation of a Host header. Details The...

CVE-2022-50185

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in nisetmcspecialregisters The last case label can write two buffers 'mcregaddressj' and 'mcdataj' with 'j' offset equal to SMCNISLANDSMCREGISTERARRAYSIZE since there are no checks for th...