Strong Membership Inference Attacks on Massive Datasets and (Moderately) Large Language Models

State-of-the-art membership inference attacks MIAs typically require training many reference models, making it difficult to scale these attacks to large pre-trained language models LLMs. As a result, prior research has either relied on weaker attacks that avoid training reference models e.g.,...

LAMDA: a Longitudinal Android Malware Benchmark for Concept Drift Analysis

Machine learning ML-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the...

Understanding the Relationship between Personal Data Privacy Literacy and Data Privacy Information Sharing by University Students

With constant threats to the safety of personal data in the United States, privacy literacy has become an increasingly important competency among university students, one that ties intimately to the information sharing behavior of these students. This survey based study examines how university...

Usability of Token-Based and Remote Electronic Signatures: a User Experience Study

As electronic signatures e-signatures become increasingly integral to secure digital transactions, understanding their usability and security perception from an end-user perspective has become crucial. This study empirically evaluates and compares two major e-signature systems -- token-based and...

LLM-Driven APT Detection for 6G Wireless Networks: a Systematic Review and Taxonomy

Sixth Generation 6G wireless networks, which are expected to be deployed in the 2030s, have already created great excitement in academia and the private sector with their extremely high communication speed and low latency rates. However, despite the ultra-low latency, high throughput, and...

ARMS: a Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain

Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from external actors. While maintainers can assess the correctness of a change request, assessing a change request's...

Benchmarking Poisoning Attacks against Retrieval-Augmented Generation

Retrieval-Augmented Generation RAG has proven effective in mitigating hallucinations in large language models by incorporating external knowledge during inference. However, this integration introduces new security vulnerabilities, particularly to poisoning attacks. Although prior work has explore...

MLRan: a Behavioural Dataset for Ransomware Analysis and Detection

Ransomware remains a critical threat to cybersecurity, yet publicly available datasets for training machine learning-based ransomware detection models are scarce and often have limited sample size, diversity, and reproducibility. In this paper, we introduce MLRan, a behavioural ransomware dataset...

Towards a Quantum-Classical Augmented Network

In the past decade, several small-scale quantum key distribution networks have been established. However, the deployment of large-scale quantum networks depends on the development of quantum repeaters, quantum channels, quantum memories, and quantum network protocols. To improve the security of...

Gentoo Linux Security Advisory 201908-27

Gentoo Linux Security Advisory 201908-27 - A vulnerability in Nautilus may allow attackers to escape the sandbox. Versions less than 3.30.5-r1 are affected...

Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems

Autonomous driving systems ADS increasingly rely on deep learning-based perception models, which remain vulnerable to adversarial attacks. In this paper, we revisit adversarial attacks and defense methods, focusing on road sign recognition and lead object detection and prediction e.g., relative...

Adaptively Secure Distributed Broadcast Encryption with Linear-Size Public Parameters

Distributed broadcast encryption DBE is a variant of broadcast encryption BE that can efficiently transmit a message to a subset of users, in which users independently generate user private keys and user public keys instead of a central trusted authority generating user keys. In this paper, we...

Modeling Interdependent Privacy Threats

The rise of online social networks, user-gene-rated content, and third-party apps made data sharing an inevitable trend, driven by both user behavior and the commercial value of personal information. As service providers amass vast amounts of data, safeguarding individual privacy has become...

An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs

Recent advances in Large Language Models LLMs have led to the widespread adoption of third-party inference services, raising critical privacy concerns. Existing methods of performing private third-party inference, such as Secure Multiparty Computation SMPC, often rely on cryptographic methods...

SecurePay: Enabling Secure and Fast Payment Processing for Platform Economy

Recent years have witnessed a rapid development of platform economy, as it effectively addresses the trust dilemma between untrusted online buyers and merchants. However, malicious platforms can misuse users' funds and information, causing severe security concerns. Previous research efforts aimed...

Gentoo Linux Security Advisory 200506-20

Gentoo Linux Security Advisory 200506-20 - Cacti is vulnerable to several SQL injection, authentication bypass and file inclusion vulnerabilities. Versions less than 0.8.6f are affected...

Architectural Backdoors for Within-Batch Data Stealing and Model Inference Manipulation

For nearly a decade the academic community has investigated backdoors in neural networks, primarily focusing on classification tasks where adversaries manipulate the model prediction. While demonstrably malicious, the immediate real-world impact of such prediction-altering attacks has remained...

Verifiable Deep Learning Inference on an Untrusted Party

Whitepaper called Verifiable Deep Learning Inference On An Untrusted Party...

Finetuning-Activated Backdoors in LLMs

Finetuning openly accessible Large Language Models LLMs has become standard practice for achieving task-specific performance improvements. Until now, finetuning has been regarded as a controlled and secure process in which training on benign datasets led to predictable behaviors. In this paper, w...

EtherBee: a Global Dataset of Ethereum Node Performance Measurements Coupled with Honeypot Interactions and Full Network Sessions

We introduce EtherBee, a global dataset integrating detailed Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. By correlating node data with granular network sessions and security events,...

Chain-Of-Lure: a Synthetic Narrative-Driven Approach to Compromise Large Language Models

In the era of rapid generative AI development, interactions between humans and large language models face significant misusing risks. Previous research has primarily focused on black-box scenarios using human-guided prompts and white-box scenarios leveraging gradient-based LLM generation methods,...

Gentoo Linux Security Advisory 201607-07

Gentoo Linux Security Advisory 201607-07 - Multiple vulnerabilities have been found in the Chromium web browser, the worst of which allows remote attackers to execute arbitrary code. Versions less than 51.0.2704.103 are affected...

Gentoo Linux Security Advisory 201607-05

Gentoo Linux Security Advisory 201607-05 - Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code. Versions less than 0.8.8h are affected...

One Model Transfer to All: on Robust Jailbreak Prompts Generation against LLMs

Safety alignment in large language models LLMs is increasingly compromised by jailbreak attacks, which can manipulate these models to generate harmful or unintended content. Investigating these attacks is crucial for uncovering model vulnerabilities. However, many existing jailbreak strategies fa...

Gentoo Linux Security Advisory 201607-06

Gentoo Linux Security Advisory 201607-06 - A buffer overflow in CUPS might allow remote attackers to execute arbitrary code. Versions less than 2.0.2-r1 are affected...

Gentoo Linux Security Advisory 201707-12

Gentoo Linux Security Advisory 201707-12 - A vulnerability in MAN DB allows local users to gain root privileges. Versions less than 2.7.6.1-r2 are affected...

Invisible Tokens, Visible Bills: the Urgent Need to Audit Hidden Operations in Opaque LLM Services

Whitepaper called Invisible Tokens, Visible Bills: The Urgent Need To Audit Hidden Operations In Opaque LLM Services...

TSA-WF: Exploring the Effectiveness of Time Series Analysis for Website Fingerprinting

Whitepaper called TSA-WF: Exploring The Effectiveness Of Time Series Analysis For Website Fingerprinting...

Towards Anonymous Neural Network Inference

We introduce funion, a system providing end-to-end sender-receiver unlinkability for neural network inference. By leveraging the Pigeonhole storage protocol and BACAP blinding-and-capability scheme from the Echomix anonymity system, funion inherits the provable security guarantees of modern...

Sec5GLoc: Securing 5G Indoor Localization Via Adversary-Resilient Deep Learning Architecture

Emerging 5G millimeter-wave and sub-6 GHz networks enable high-accuracy indoor localization, but security and privacy vulnerabilities pose serious challenges. In this paper, we identify and address threats including location spoofing and adversarial signal manipulation against 5G-based indoor...

Gentoo Linux Security Advisory 201607-04

Gentoo Linux Security Advisory 201607-04 - Multiple vulnerabilities have been found in GD, the worst of which allows remote attackers to execute arbitrary code. Versions less than 2.2.2 are affected...

JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models

Whitepaper called JALMBench: Benchmarking Jailbreak Vulnerabilities In Audio Language Models...

Gaming Tool Preferences in Agentic LLMs

Large language models LLMs can now access a wide range of external tools, thanks to the Model Context Protocol MCP. This greatly expands their abilities as various agents. However, LLMs rely entirely on the text descriptions of tools to decide which ones to use--a process that is surprisingly...

ACSE-Eval: Can LLMs Threat Model Real-World Cloud Infrastructure?

While Large Language Models have shown promise in cybersecurity applications, their effectiveness in identifying security threats within cloud deployments remains unexplored. This paper introduces AWS Cloud Security Engineering Eval, a novel dataset for evaluating LLMs cloud security threat...

A Critical Evaluation of Defenses against Prompt Injection Attacks

Large Language Models LLMs are vulnerable to prompt injection attacks, and several defenses have recently been proposed, often claiming to mitigate these attacks successfully. However, we argue that existing studies lack a principled approach to evaluating these defenses. In this paper, we argue...

AI/ML for 5G and beyond Cybersecurity

The advancements in communication technology 5G and beyond and global connectivity Internet of Things IoT also come with new security problems that will need to be addressed in the next few years. The threats and vulnerabilities introduced by AI/ML based 5G and beyond IoT systems need to be...

Large Language Models in the IoT Ecosystem -- a Survey on Security Challenges and Applications

The Internet of Things IoT and Large Language Models LLMs have been two major emerging players in the information technology era. Although there has been significant coverage of their individual capabilities, our literature survey sheds some light on the integration and interaction of LLMs and Io...

Wazuh 4.10.2

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...

Privacy-Preserving Bathroom Monitoring for Elderly Emergencies Using PIR and LiDAR Sensors

In-home elderly monitoring requires systems that can detect emergency events - such as falls or prolonged inactivity - while preserving privacy and requiring no user input. These systems must be embedded into the surrounding environment, capable of capturing activity, and responding promptly. Thi...

A Linear Approach to Data Poisoning

We investigate the theoretical foundations of data poisoning attacks in machine learning models. Our analysis reveals that the Hessian with respect to the input serves as a diagnostic tool for detecting poisoning, exhibiting spectral signatures that characterize compromised datasets. We use rando...

Gentoo Linux Security Advisory 201908-26

Gentoo Linux Security Advisory 201908-26 - Multiple vulnerabilities have been found in libofx, the worst of which could result in the arbitrary execution of code. Versions less than 0.9.14 are affected...

Advancing Security with Digital Twins: a Comprehensive Survey

The proliferation of electronic devices has greatly transformed every aspect of human life, such as communication, healthcare, transportation, and energy. Unfortunately, the global electronics supply chain is vulnerable to various attacks, including piracy of intellectual properties, tampering,...

GRAudit Grep Auditing Tool 3.9

Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility, grep. It's comparable to other static analysis applications like RATS, SWAAT, and flaw-finder while keeping the technical requirements to a minimum and being very...

Understanding the Security Landscape of Embedded Non-Volatile Memories: a Comprehensive Survey

The modern semiconductor industry requires memory solutions that can keep pace with the high-speed demands of high-performance computing. Embedded non-volatile memories eNVMs address these requirements by offering faster access to stored data at an improved computational throughput and efficiency...

Privacy-Aware Cyberterrorism Network Analysis Using Graph Neural Networks and Federated Learning

Cyberterrorism poses a formidable threat to digital infrastructures, with increasing reliance on encrypted, decentralized platforms that obscure threat actor activity. To address the challenge of analyzing such adversarial networks while preserving the privacy of distributed intelligence data, we...

OpenSSL Security Advisory 20250522

OpenSSL Security Advisory 20250522 - Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate...

LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance

Large language models LLMs are increasingly applied in fields such as finance, education, and governance due to their ability to generate human-like text and adapt to specialized tasks. However, their widespread adoption raises critical concerns about data privacy and security, including the risk...

Robust LLM Fingerprinting Via Domain-Specific Watermarks

As open-source language models OSMs grow more capable and are widely shared and finetuned, ensuring model provenance, i.e., identifying the origin of a given model instance, has become an increasingly important issue. At the same time, existing backdoor-based model fingerprinting techniques often...

WordPress Madara 2.2.2 Local File Inclusion

WordPress Madara theme versions 2.2.2 and below suffer from a local file inclusion vulnerability...

LogStamping: a Blockchain-Based Log Auditing Approach for Large-Scale Systems

Log management is crucial for ensuring the security, integrity, and compliance of modern information systems. Traditional log management solutions face challenges in achieving tamper-proofing, scalability, and real-time processing in distributed environments. This paper presents a blockchain-base...