7579 matches found
Gentoo Linux Security Advisory 200506-20
Gentoo Linux Security Advisory 200506-20 - Cacti is vulnerable to several SQL injection, authentication bypass and file inclusion vulnerabilities. Versions less than 0.8.6f are affected...
Gaming Tool Preferences in Agentic LLMs
Large language models LLMs can now access a wide range of external tools, thanks to the Model Context Protocol MCP. This greatly expands their abilities as various agents. However, LLMs rely entirely on the text descriptions of tools to decide which ones to use--a process that is surprisingly...
Towards Anonymous Neural Network Inference
We introduce funion, a system providing end-to-end sender-receiver unlinkability for neural network inference. By leveraging the Pigeonhole storage protocol and BACAP blinding-and-capability scheme from the Echomix anonymity system, funion inherits the provable security guarantees of modern...
Adaptively Secure Distributed Broadcast Encryption with Linear-Size Public Parameters
Distributed broadcast encryption DBE is a variant of broadcast encryption BE that can efficiently transmit a message to a subset of users, in which users independently generate user private keys and user public keys instead of a central trusted authority generating user keys. In this paper, we...
One Model Transfer to All: on Robust Jailbreak Prompts Generation against LLMs
Safety alignment in large language models LLMs is increasingly compromised by jailbreak attacks, which can manipulate these models to generate harmful or unintended content. Investigating these attacks is crucial for uncovering model vulnerabilities. However, many existing jailbreak strategies fa...
Modeling Interdependent Privacy Threats
The rise of online social networks, user-gene-rated content, and third-party apps made data sharing an inevitable trend, driven by both user behavior and the commercial value of personal information. As service providers amass vast amounts of data, safeguarding individual privacy has become...
TSA-WF: Exploring the Effectiveness of Time Series Analysis for Website Fingerprinting
Whitepaper called TSA-WF: Exploring The Effectiveness Of Time Series Analysis For Website Fingerprinting...
Privacy-Preserving Bathroom Monitoring for Elderly Emergencies Using PIR and LiDAR Sensors
In-home elderly monitoring requires systems that can detect emergency events - such as falls or prolonged inactivity - while preserving privacy and requiring no user input. These systems must be embedded into the surrounding environment, capable of capturing activity, and responding promptly. Thi...
Sec5GLoc: Securing 5G Indoor Localization Via Adversary-Resilient Deep Learning Architecture
Emerging 5G millimeter-wave and sub-6 GHz networks enable high-accuracy indoor localization, but security and privacy vulnerabilities pose serious challenges. In this paper, we identify and address threats including location spoofing and adversarial signal manipulation against 5G-based indoor...
A Linear Approach to Data Poisoning
We investigate the theoretical foundations of data poisoning attacks in machine learning models. Our analysis reveals that the Hessian with respect to the input serves as a diagnostic tool for detecting poisoning, exhibiting spectral signatures that characterize compromised datasets. We use rando...
Gentoo Linux Security Advisory 201607-05
Gentoo Linux Security Advisory 201607-05 - Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code. Versions less than 0.8.8h are affected...
Gentoo Linux Security Advisory 201908-26
Gentoo Linux Security Advisory 201908-26 - Multiple vulnerabilities have been found in libofx, the worst of which could result in the arbitrary execution of code. Versions less than 0.9.14 are affected...
Gentoo Linux Security Advisory 201908-27
Gentoo Linux Security Advisory 201908-27 - A vulnerability in Nautilus may allow attackers to escape the sandbox. Versions less than 3.30.5-r1 are affected...
Invisible Tokens, Visible Bills: the Urgent Need to Audit Hidden Operations in Opaque LLM Services
Whitepaper called Invisible Tokens, Visible Bills: The Urgent Need To Audit Hidden Operations In Opaque LLM Services...
SecurePay: Enabling Secure and Fast Payment Processing for Platform Economy
Recent years have witnessed a rapid development of platform economy, as it effectively addresses the trust dilemma between untrusted online buyers and merchants. However, malicious platforms can misuse users' funds and information, causing severe security concerns. Previous research efforts aimed...
Finetuning-Activated Backdoors in LLMs
Finetuning openly accessible Large Language Models LLMs has become standard practice for achieving task-specific performance improvements. Until now, finetuning has been regarded as a controlled and secure process in which training on benign datasets led to predictable behaviors. In this paper, w...
Architectural Backdoors for Within-Batch Data Stealing and Model Inference Manipulation
For nearly a decade the academic community has investigated backdoors in neural networks, primarily focusing on classification tasks where adversaries manipulate the model prediction. While demonstrably malicious, the immediate real-world impact of such prediction-altering attacks has remained...
Gentoo Linux Security Advisory 201607-06
Gentoo Linux Security Advisory 201607-06 - A buffer overflow in CUPS might allow remote attackers to execute arbitrary code. Versions less than 2.0.2-r1 are affected...
JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models
Whitepaper called JALMBench: Benchmarking Jailbreak Vulnerabilities In Audio Language Models...
Chain-Of-Lure: a Synthetic Narrative-Driven Approach to Compromise Large Language Models
In the era of rapid generative AI development, interactions between humans and large language models face significant misusing risks. Previous research has primarily focused on black-box scenarios using human-guided prompts and white-box scenarios leveraging gradient-based LLM generation methods,...
Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
Autonomous driving systems ADS increasingly rely on deep learning-based perception models, which remain vulnerable to adversarial attacks. In this paper, we revisit adversarial attacks and defense methods, focusing on road sign recognition and lead object detection and prediction e.g., relative...
ACSE-Eval: Can LLMs Threat Model Real-World Cloud Infrastructure?
While Large Language Models have shown promise in cybersecurity applications, their effectiveness in identifying security threats within cloud deployments remains unexplored. This paper introduces AWS Cloud Security Engineering Eval, a novel dataset for evaluating LLMs cloud security threat...
Gentoo Linux Security Advisory 201707-12
Gentoo Linux Security Advisory 201707-12 - A vulnerability in MAN DB allows local users to gain root privileges. Versions less than 2.7.6.1-r2 are affected...
An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMs
Recent advances in Large Language Models LLMs have led to the widespread adoption of third-party inference services, raising critical privacy concerns. Existing methods of performing private third-party inference, such as Secure Multiparty Computation SMPC, often rely on cryptographic methods...
Large Language Models in the IoT Ecosystem -- a Survey on Security Challenges and Applications
The Internet of Things IoT and Large Language Models LLMs have been two major emerging players in the information technology era. Although there has been significant coverage of their individual capabilities, our literature survey sheds some light on the integration and interaction of LLMs and Io...
AI/ML for 5G and beyond Cybersecurity
The advancements in communication technology 5G and beyond and global connectivity Internet of Things IoT also come with new security problems that will need to be addressed in the next few years. The threats and vulnerabilities introduced by AI/ML based 5G and beyond IoT systems need to be...
Gentoo Linux Security Advisory 201607-04
Gentoo Linux Security Advisory 201607-04 - Multiple vulnerabilities have been found in GD, the worst of which allows remote attackers to execute arbitrary code. Versions less than 2.2.2 are affected...
Wazuh 4.10.2
Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...
Vehicular Intrusion Detection System for Controller Area Network: a Comprehensive Survey and Evaluation
The progress of automotive technologies has made cybersecurity a crucial focus, leading to various cyber attacks. These attacks primarily target the Controller Area Network CAN and specialized Electronic Control Units ECUs. In order to mitigate these attacks and bolster the security of vehicular...
Can ChatGPT Perform Image Splicing Detection? A Preliminary Study
Multimodal Large Language Models MLLMs like GPT-4V are capable of reasoning across text and image modalities, showing promise in a variety of complex vision-language tasks. In this preliminary study, we investigate the out-of-the-box capabilities of GPT-4V in the domain of image forensics,...
VIVID: a Novel Approach to Remediation Prioritization in Static Application Security Testing (SAST)
Static Application Security Testing SAST enables organizations to detect vulnerabilities in code early; however, major SAST platforms do not include visual aids and present little insight on correlations between tainted data chains. We propose VIVID - Vulnerability Information Via Data flow - a...
Verifying Differentially Private Median Estimation
Differential Privacy DP is a robust privacy guarantee that is widely employed in private data analysis today, finding broad application in domains such as statistical query release and machine learning. However, DP achieves privacy by introducing noise into data or query answers, which malicious...
Advancing Security with Digital Twins: a Comprehensive Survey
The proliferation of electronic devices has greatly transformed every aspect of human life, such as communication, healthcare, transportation, and energy. Unfortunately, the global electronics supply chain is vulnerable to various attacks, including piracy of intellectual properties, tampering,...
GRAudit Grep Auditing Tool 3.9
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility, grep. It's comparable to other static analysis applications like RATS, SWAAT, and flaw-finder while keeping the technical requirements to a minimum and being very...
Understanding the Security Landscape of Embedded Non-Volatile Memories: a Comprehensive Survey
The modern semiconductor industry requires memory solutions that can keep pace with the high-speed demands of high-performance computing. Embedded non-volatile memories eNVMs address these requirements by offering faster access to stored data at an improved computational throughput and efficiency...
BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models Via Objective-Decoupled Optimization
Vision-Language-Action VLA models have advanced robotic control by enabling end-to-end decision-making directly from multimodal inputs. However, their tightly coupled architectures expose novel security vulnerabilities. Unlike traditional adversarial perturbations, backdoor attacks represent a...
Mitigating Fine-Tuning Risks in LLMs Via Safety-Aware Probing Optimization
The significant progress of large language models LLMs has led to remarkable achievements across numerous applications. However, their ability to generate harmful content has sparked substantial safety concerns. Despite the implementation of safety alignment techniques during the pre-training...
An End-To-End Model for Logits Based Large Language Models Watermarking
The rise of LLMs has increased concerns over source tracing and copyright protection for AIGC, highlighting the need for advanced detection technologies. Passive detection methods usually face high false positives, while active watermarking techniques using logits or sampling manipulation offer...
CAIN: Hijacking LLM-Humans Conversations Via a Two-Stage Malicious System Prompt Generation and Refining Framework
Large language models LLMs have advanced many applications, but are also known to be vulnerable to adversarial attacks. In this work, we introduce a novel security threat: hijacking AI-human conversations by manipulating LLMs' system prompts to produce malicious answers only to specific targeted...
Poster: Towards an Automated Security Testing Framework for Industrial UEs
With the ongoing adoption of 5G for communication in industrial systems and critical infrastructure, the security of industrial UEs such as 5G-enabled industrial robots becomes an increasingly important topic. Most notably, to meet the stringent security requirements of industrial deployments,...
LogStamping: a Blockchain-Based Log Auditing Approach for Large-Scale Systems
Log management is crucial for ensuring the security, integrity, and compliance of modern information systems. Traditional log management solutions face challenges in achieving tamper-proofing, scalability, and real-time processing in distributed environments. This paper presents a blockchain-base...
When Safety Detectors Aren'T Enough: a Stealthy and Effective Jailbreak Attack on LLMs Via Steganographic Techniques
Jailbreak attacks pose a serious threat to large language models LLMs by bypassing built-in safety mechanisms and leading to harmful outputs. Studying these attacks is crucial for identifying vulnerabilities and improving model security. This paper presents a systematic survey of jailbreak method...
Harry Potter Is Still Here! Probing Knowledge Leakage in Targeted Unlearned Large Language Models Via Automated Adversarial Prompting
This work presents LURK Latent UnleaRned Knowledge, a novel framework that probes for hidden retained knowledge in unlearned LLMs through adversarial suffix prompting. LURK automatically generates adversarial prompt suffixes designed to elicit residual knowledge about the Harry Potter domain, a...
Enhancing Meme Token Market Transparency: a Multi-Dimensional Entity-Linked Address Analysis for Liquidity Risk Evaluation
Meme tokens represent a distinctive asset class within the cryptocurrency ecosystem, characterized by high community engagement, significant market volatility, and heightened vulnerability to market manipulation. This paper introduces an innovative approach to assessing liquidity risk in meme tok...
LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance
Large language models LLMs are increasingly applied in fields such as finance, education, and governance due to their ability to generate human-like text and adapt to specialized tasks. However, their widespread adoption raises critical concerns about data privacy and security, including the risk...
Robust LLM Fingerprinting Via Domain-Specific Watermarks
As open-source language models OSMs grow more capable and are widely shared and finetuned, ensuring model provenance, i.e., identifying the origin of a given model instance, has become an increasingly important issue. At the same time, existing backdoor-based model fingerprinting techniques often...
Dynamic Encryption-Based Cloud Security Model Using Facial Image and Password-Based Key Generation for Multimedia Data
In this cloud-dependent era, various security techniques, such as encryption, steganography, and hybrid approaches, have been utilized in cloud computing to enhance security, maintain enormous storage capacity, and provide ease of access. However, the absence of data type-specific encryption and...
All You Need Is "Leet": Evading Hate-Speech Detection AI
Social media and online forums are increasingly becoming popular. Unfortunately, these platforms are being used for spreading hate speech. In this paper, we design black-box techniques to protect users from hate-speech on online platforms by generating perturbations that can fool state of the art...
Timestamp Manipulation: Timestamp-Based Nakamoto-Style Blockchains Are Vulnerable
Nakamoto consensus are the most widely adopted decentralized consensus mechanism in cryptocurrency systems. Since it was proposed in 2008, many studies have focused on analyzing its security. Most of them focus on maximizing the profit of the adversary. Examples include the selfish mining attack ...