From Worst-Case Hardness of NP to Quantum Cryptography Via Quantum Indistinguishability Obfuscation

Whitepaper called From Worst-Case Hardness Of NP To Quantum Cryptography Via Quantum Indistinguishability Obfuscation...

RepuNet: a Reputation System for Mitigating Malicious Clients in DFL

Decentralized Federated Learning DFL enables nodes to collaboratively train models without a central server, introducing new vulnerabilities since each node independently selects peers for model aggregation. Malicious nodes may exploit this autonomy by sending corrupted models model poisoning,...

Autonomous Cyber Resilience Via a Co-Evolutionary Arms Race within a Fortified Digital Twin Sandbox

The convergence of IT and OT has created hyper-connected ICS, exposing critical infrastructure to a new class of adaptive, intelligent adversaries that render static defenses obsolete. Existing security paradigms often fail to address a foundational "Trinity of Trust," comprising the fidelity of...

Decompiling Smart Contracts with a Large Language Model

The widespread lack of broad source code verification on blockchain explorers such as Etherscan, where despite 78,047,845 smart contracts deployed on Ethereum as of May 26, 2025, a mere 767,520 1% are open source, presents a severe impediment to blockchain security. This opacity necessitates the...

Evaluating Disassembly Errors with Only Binaries

Disassemblers are crucial in the analysis and modification of binaries. Existing works showing disassembler errors largely rely on practical implementation without specific guarantees and assume source code and compiler toolchains to evaluate ground truth. However, the assumption of source code i...

Secure Multi-Key Homomorphic Encryption with Application to Privacy-Preserving Federated Learning

Whitepaper called Secure Multi-Key Homomorphic Encryption With Application To Privacy-Preserving Federated Learning...

Quest KACE Systems Management Appliance 14.1 Unauthenticated License Replacement

Seralys Security Advisory - Quest KACE SMA allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service. Version 14.1 is confirmed...

On the Efficacy of Old Features for the Detection of New Bots

For more than a decade now, academicians and online platform administrators have been studying solutions to the problem of bot detection. Bots are computer algorithms whose use is far from being benign: malicious bots are purposely created to distribute spam, sponsor public characters and,...

ZK-SERIES: Privacy-Preserving Authentication Using Temporal Biometric Data

Biometric authentication relies on physiological or behavioral traits that are inherent to a user, making them difficult to lose, forge or forget. Biometric data with a temporal component enable the following authentication protocol: recent readings of the underlying biometrics are encoded as tim...

Yotta: a Large-Scale Trustless Data Trading Scheme for Blockchain System

Data trading is one of the key focuses of Web 3.0. However, all the current methods that rely on blockchain-based smart contracts for data exchange cannot support large-scale data trading while ensuring data security, which falls short of fulfilling the spirit of Web 3.0. Even worse, there is...

FORGE: an LLM-Driven Framework for Large-Scale Smart Contract Vulnerability Dataset Construction

High-quality smart contract vulnerability datasets are critical for evaluating security tools and advancing smart contract security research. Two major limitations of current manual dataset construction are 1 labor-intensive and error-prone annotation processes limiting the scale, quality, and...

DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?

Adversarial examples are small and often imperceptible perturbations crafted to fool machine learning models. These attacks seriously threaten the reliability of deep neural networks, especially in security-sensitive domains. Evasion attacks, a form of adversarial attack where input is modified a...

Adaptive Alert Prioritisation in Security Operations Centres Via Learning to Defer with Human Feedback

Alert prioritisation AP is crucial for security operations centres SOCs to manage the overwhelming volume of alerts and ensure timely detection and response to genuine threats, while minimising alert fatigue. Although predictive AI can process large alert volumes and identify known patterns, it...

Enhancing Security in LLM Applications: a Performance Evaluation of Early Detection Systems

Prompt injection threatens novel applications that emerge from adapting LLMs for various user tasks. The newly developed LLM-based software applications become more ubiquitous and diverse. However, the threat of prompt injection attacks undermines the security of these systems as the mitigation a...

Towards Provable (In)Secure Model Weight Release Schemes

Recent secure weight release schemes claim to enable open-source model distribution while protecting model ownership and preventing misuse. However, these approaches lack rigorous security foundations and provide only informal security guarantees. Inspired by established works in cryptography, we...

Intelligent ARP Spoofing Detection Using Multi-Layered Machine Learning (ML) Techniques for IoT Networks

Address Resolution Protocol ARP spoofing remains a critical threat to IoT networks, enabling attackers to intercept, modify, or disrupt data transmission by exploiting ARP's lack of authentication. The decentralized and resource-constrained nature of IoT environments amplifies this vulnerability,...

Accurate BGV Parameters Selection: Accounting for Secret and Public Key Dependencies in Average-Case Analysis

The Brakerski-Gentry-Vaikuntanathan BGV scheme is one of the most significant fully homomorphic encryption FHE schemes. It belongs to a class of FHE schemes whose security is based on the presumed intractability of the Learning with Errors LWE problem and its ring variant RLWE. Such schemes deal...

VideoMark: a Distortion-Free Robust Watermarking Framework for Video Diffusion Models

Whitepaper called VideoMark: A Distortion-Free Robust Watermarking Framework For Video Diffusion Models...

Amplifying Machine Learning Attacks through Strategic Compositions

Machine learning ML models are proving to be vulnerable to a variety of attacks that allow the adversary to learn sensitive information, cause mispredictions, and more. While these attacks have been extensively studied, current research predominantly focuses on analyzing each attack type...

Security Assessment of DeepSeek and GPT Series Models against Jailbreak Attacks

The widespread deployment of large language models LLMs has raised critical concerns over their vulnerability to jailbreak attacks, i.e., adversarial prompts that bypass alignment mechanisms and elicit harmful or policy-violating outputs. While proprietary models like GPT-4 have undergone extensi...

Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models

Are there any conditions under which a generative model's outputs are guaranteed not to infringe the copyrights of its training data? This is the question of "provable copyright protection" first posed by Vyas, Kakade, and Barak ICML 2023. They define near access-freeness NAF and propose it as...

Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017

Identifying suitable machine learning paradigms for intrusion detection remains critical for building effective and generalizable security solutions. In this study, we present a controlled comparison of four representative models - Multi-Layer Perceptron MLP, 1D Convolutional Neural Network CNN,...

Understanding the Theoretical Guarantees of DPM

In this study, we conducted an in-depth examination of the utility analysis of the differentially private mechanism DPM. The authors of DPM have already established the probability of a good split being selected and of DPM halting. In this study, we expanded the analysis of the stopping criterion...

Cellular Automata As Generators of Interleaving Sequences

An interleaving sequence is obtained by combining or intertwining elements from two or more sequences. On the other hand, cellular automata are known to be generators for keystream sequences. In this paper we present two families of one-dimensional cellular automata as generators of interleaving...

Vulnerability Assessment Combining CVSS Temporal Metrics and Bayesian Networks

Vulnerability assessment is a critical challenge in cybersecurity, particularly in industrial environments. This work presents an innovative approach by incorporating the temporal dimension into vulnerability assessment, an aspect neglected in existing literature. Specifically, this paper focuses...

Physical Layer Challenge-Response Authentication between Ambient Backscatter Devices

Ambient backscatter communication AmBC has become an integral part of ubiquitous Internet of Things IoT applications due to its energy-harvesting capabilities and ultra-low-power consumption. However, the open wireless environment exposes AmBC systems to various attacks, and existing authenticati...

Private Model Personalization Revisited

Whitepaper called Private Model Personalization Revisited...

Network Structures As an Attack Surface: Topology-Based Privacy Leakage in Federated Learning

Federated learning systems increasingly rely on diverse network topologies to address scalability and organizational constraints. While existing privacy research focuses on gradient-based attacks, the privacy implications of network topology knowledge remain critically understudied. We conduct th...

Stegano 2.0.0

Stegano is a basic Python Steganography module. Stegano implements two methods of hiding: using the red portion of a pixel to hide ASCII messages, and using the Least Significant Bit LSB technique. It is possible to use a more advanced LSB method based on integers sets. The sets Sieve of...

Deep CNN Face Matchers Inherently Support Revocable Biometric Templates

One common critique of biometric authentication is that if an individual's biometric is compromised, then the individual has no recourse. The concept of revocable biometrics was developed to address this concern. A biometric scheme is revocable if an individual can have their current enrollment i...

HARPT: a Corpus for Analyzing Consumers' Trust and Privacy Concerns in Mobile Health Apps

We present HARPT, a large-scale annotated corpus of mobile health app store reviews aimed at advancing research in user privacy and trust. The dataset comprises over 480,000 user reviews labeled into seven categories that capture critical aspects of trust in applications, trust in providers and...

Automatic Selection of Protections to Mitigate Risks against Software Applications

This paper introduces a novel approach for the automated selection of software protections to mitigate MATE risks against critical assets within software applications. We formalize the key elements involved in protection decision-making - including code artifacts, assets, security requirements,...

Design High-Confidence Computers Using Trusted Instructional Set Architecture and Emulators

High-confidence computing relies on trusted instructional set architecture, sealed kernels, and secure operating systems. Cloud computing depends on trusted systems for virtualization tasks. Branch predictions and pipelines are essential in improving performance of a CPU/GPU. But Spectre and...

Faydam Datalogger 2.7.0 SQL Injection

Faydam Datalogger versions 2.7.0 and below suffer from a remote SQL injection vulnerability...

A Comparative Study and Implementation of Key Derivation Functions Standardized by NIST and IEEE

Since many applications and services require pseudorandom numbers PRNs, it is feasible to generate specific PRNs under given key values and input messages using Key Derivation Functions KDFs. These KDFs are primarily constructed based on Message Authentication Codes MACs, where the MAC serves as ...

Multi-Domain Anomaly Detection in a 5G Network

With the advent of 5G, mobile networks are becoming more dynamic and will therefore present a wider attack surface. To secure these new systems, we propose a multi-domain anomaly detection method that is distinguished by the study of traffic correlation on three dimensions: temporal by analyzing...

LURK-T: Limited Use of Remote Keys with Added Trust in TLS 1.3

In many web applications, such as Content Delivery Networks CDNs, TLS credentials are shared, e.g., between the website's TLS origin server and the CDN's edge servers, which can be distributed around the globe. To enhance the security and trust for TLS 1.3 in such scenarios, we propose LURK-T, a...

Restoring Gaussian Blurred Face Images for Deanonymization Attacks

Gaussian blur is widely used to blur human faces in sensitive photos before the photos are posted on the Internet. However, it is unclear to what extent the blurred faces can be restored and used to re-identify the person, especially under a high-blurring setting. In this paper, we explore this...

Cost-Effective Optimization and Implementation of the CRT-Paillier Decryption Algorithm for Enhanced Performance

To address the privacy protection problem in cloud computing, privacy enhancement techniques such as the Paillier additive homomorphism algorithm are receiving widespread attention. Paillier algorithm allows addition and scalar multiplication operations in dencrypted state, which can effectively...

Multi-Domain Anomaly Detection in a 5G Network

With the advent of 5G, mobile networks are becoming more dynamic and will therefore present a wider attack surface. To secure these new systems, we propose a multi-domain anomaly detection method that is distinguished by the study of traffic correlation on three dimensions: temporal by analyzing...

Self-Stabilizing Replicated State Machine Coping with Byzantine and Recurring Transient Faults

Whitepaper called Self-Stabilizing Replicated State Machine Coping With Byzantine And Recurring Transient Faults...

KEENHash: Hashing Programs into Function-Aware Embeddings for Large-Scale Binary Code Similarity Analysis

Binary code similarity analysis BCSA is a crucial research area in many fields such as cybersecurity. Specifically, function-level diffing tools are the most widely used in BCSA: they perform function matching one by one for evaluating the similarity between binary programs. However, such methods...

Risks and Benefits of LLMs and GenAI for Platform Integrity, Healthcare Diagnostics, Cybersecurity, Privacy and AI Safety: a Comprehensive Survey, Roadmap and Implementation Blueprint

Large Language Models LLMs and generative AI GenAI systems such as ChatGPT, Claude, Gemini, LLaMA, and Copilot, developed by OpenAI, Anthropic, Google, Meta, and Microsoft are reshaping digital platforms and app ecosystems while introducing key challenges in cybersecurity, privacy, and platform...

ArgHiTZ at ArchEHR-QA 2025: a Two-Step Divide and Conquer Approach to Patient Question Answering for Top Factuality

This work presents three different approaches to address the ArchEHR-QA 2025 Shared Task on automated patient question answering. We introduce an end-to-end prompt-based baseline and two two-step methods to divide the task, without utilizing any external knowledge. Both two step approaches first...

A Fast, Reliable, and Secure Programming Language for LLM Agents with Code Actions

Modern large language models LLMs are often deployed as agents, calling external tools adaptively to solve tasks. Rather than directly calling tools, it can be more effective for LLMs to write code to perform the tool calls, enabling them to automatically generate complex control flow such as...

SoK: Current State of Ethereum'S Enshrined Proposer Builder Separation

Initially introduced to Ethereum via Flashbots' MEV-boost, Proposer-Builder Separation allows proposers to auction off blockspace to a market of transaction orderers, known as builders. PBS is currently available to validators through the aforementioned MEV-boost, but its unregulated and...

FAME: a Lightweight Spatio-Temporal Network for Model Attribution of Face-Swap Deepfakes

The widespread emergence of face-swap Deepfake videos poses growing risks to digital security, privacy, and media integrity, necessitating effective forensic tools for identifying the source of such manipulations. Although most prior research has focused primarily on binary Deepfake detection, th...

Leveraging Photonic Interconnects for Scalable and Efficient Fully Homomorphic Encryption

Fully Homomorphic Encryption FHE facilitates secure computations on encrypted data but imposes significant demands on memory bandwidth and computational power. While current FHE accelerators focus on optimizing computation, they often face bandwidth limitations that result in performance...

Pushing the Limits of Safety: a Technical Report on the ATLAS Challenge 2025

Multimodal Large Language Models MLLMs have enabled transformative advancements across diverse applications but remain susceptible to safety threats, especially jailbreak attacks that induce harmful outputs. To systematically evaluate and improve their safety, we organized the Adversarial Testing...

Image Corruption-Inspired Membership Inference Attacks against Large Vision-Language Models

Large vision-language models LVLMs have demonstrated outstanding performance in many downstream tasks. However, LVLMs are trained on large-scale datasets, which can pose privacy risks if training images contain sensitive information. Therefore, it is important to detect whether an image is used t...