8745 matches found
Mono: Is Your "Clean" Vulnerability Dataset Really Solvable? Exposing and Trapping Undecidable Patches and Beyond
The quantity and quality of vulnerability datasets are essential for developing deep learning solutions to vulnerability-related tasks. Due to the limited availability of vulnerabilities, a common approach to building such datasets is analyzing security patches in source code. However, existing...
ContextBuddy: AI-Enhanced Contextual Insights for Security Alert Investigation (Applied to Intrusion Detection)
Modern Security Operations Centres SOCs integrate diverse tools, such as SIEM, IDS, and XDR systems, offering rich contextual data, including alert enrichments, flow features, and similar case histories. Yet, analysts must still manually determine which of these contextual cues are most relevant...
SAGE: Exploring the Boundaries of Unsafe Concept Domain with Semantic-Augment Erasing
Diffusion models DMs have achieved significant progress in text-to-image generation. However, the inevitable inclusion of sensitive information during pre-training poses safety risks, such as unsafe content generation and copyright infringement. Concept erasing finetunes weights to unlearn...
Auditing Black-Box LLM APIs with a Rank-Based Uniformity Test
As API access becomes a primary interface to large language models LLMs, users often interact with black-box systems that offer little transparency into the deployed model. To reduce costs or maliciously alter model behaviors, API providers may discreetly serve quantized or fine-tuned variants,...
SmartAttack: Air-Gap Attack Via Smartwatches
Air-gapped systems are considered highly secure against data leaks due to their physical isolation from external networks. Despite this protection, ultrasonic communication has been demonstrated as an effective method for exfiltrating data from such systems. While smartphones have been extensivel...
What Is the Cost of Differential Privacy for Deep Learning-Based Trajectory Generation?
While location trajectories offer valuable insights, they also reveal sensitive personal information. Differential Privacy DP offers formal protection, but achieving a favourable utility-privacy trade-off remains challenging. Recent works explore deep learning-based generative models to produce...
Secure Data Access in Cloud Environments Using Quantum Cryptography
Cloud computing has made storing and accessing data easier but keeping it secure is a big challenge nowadays. Traditional methods of ensuring data may not be strong enough in the future when powerful quantum computers become available. To solve this problem, this study uses quantum cryptography t...
Safeguarding Multimodal Knowledge Copyright in the RAG-As-A-Service Environment
As Retrieval-Augmented Generation RAG evolves into service-oriented platforms Rag-as-a-Service with shared knowledge bases, protecting the copyright of contributed data becomes essential. Existing watermarking methods in RAG focus solely on textual knowledge, leaving image knowledge unprotected. ...
ABC-FHE : a Resource-Efficient Accelerator Enabling Bootstrappable Parameters for Client-Side Fully Homomorphic Encryption
As the demand for privacy-preserving computation continues to grow, fully homomorphic encryption FHE-which enables continuous computation on encrypted data-has become a critical solution. However, its adoption is hindered by significant computational overhead, requiring 10000-fold more computatio...
Lightweight and High-Throughput Secure Logging for Internet of Things and Cold Cloud Continuum
The growing deployment of resource-limited Internet of Things IoT devices and their expanding attack surfaces demand efficient and scalable security mechanisms. System logs are vital for the trust and auditability of IoT, and offloading their maintenance to a Cold Storage-as-a-Service Cold-STaaS...
Securing Generative AI Agentic Workflows: Risks, Mitigation, and a Proposed Firewall Architecture
Generative Artificial Intelligence GenAI presents significant advancements but also introduces novel security challenges, particularly within agentic workflows where AI agents operate autonomously. These risks escalate in multi-agent systems due to increased interaction complexity. This paper...
WordPress Celestial Aura Theme 2.2 Shell Upload
WordPress Celestial Aura Theme versions 2.2 and below suffer from a remote shell upload vulnerability...
Symbolic Generation and Modular Embedding of High-Quality Abc-Triples
We present a symbolic identity for generating integer triples $a, b, c$ satisfying $a + b = c$, inspired by structural features of the \emphabc conjecture. The construction uses powers of $2$ and $3$ in combination with modular inversion in $\mathbbZ/3^p\mathbbZ$, leading to a parametric identity...
TimeWak: Temporal Chained-Hashing Watermark for Time Series Data
Synthetic time series generated by diffusion models enable sharing privacy-sensitive datasets, such as patients' functional MRI records. Key criteria for synthetic data include high data utility and traceability to verify the data source. Recent watermarking methods embed in homogeneous latent...
ZTaint-Havoc: from Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference
Fuzzing is a widely used technique for discovering software vulnerabilities, but identifying hot bytes that influence program behavior remains challenging. Traditional taint analysis can track such bytes white-box, but suffers from scalability issue. Fuzzing-Driven Taint Inference FTI offers a...
Navigating Cookie Consent Violations across the Globe
Online services provide users with cookie banners to accept/reject the cookies placed on their web browsers. Despite the increased adoption of cookie banners, little has been done to ensure that cookie consent is compliant with privacy laws around the globe. Prior studies have found that cookies...
Boosting Gradient Leakage Attacks: Data Reconstruction in Realistic FL Settings
Federated learning FL enables collaborative model training among multiple clients without the need to expose raw data. Its ability to safeguard privacy, at the heart of FL, has recently been a hot-button debate topic. To elaborate, several studies have introduced a type of attacks known as gradie...
WGLE:Backdoor-Free and Multi-Bit Black-Box Watermarking for Graph Neural Networks
Graph Neural Networks GNNs are increasingly deployed in graph-related applications, making ownership verification critical to protect their intellectual property against model theft. Fingerprinting and black-box watermarking are two main methods. However, the former relies on determining model...
Apple iMessage Zero-Click Key Theft / Remote Code Execution
This is a strategic public disclosure of a zero-click iMessage exploit chain that was discovered live on iOS 18.2 and remained unpatched through iOS 18.4. It enabled Secure Enclave key theft, wormable remote code execution, and undetectable crypto wallet exfiltration. Despite responsible...
SoK: Machine Unlearning for Large Language Models
Large language model LLM unlearning has become a critical topic in machine learning, aiming to eliminate the influence of specific training data or knowledge without retraining the model from scratch. A variety of techniques have been proposed, including Gradient Ascent, model editing, and...
Explainable AI for Enhancing IDS against Advanced Persistent Kill Chain
Advanced Persistent Threats APTs represent a sophisticated and persistent cy-bersecurity challenge, characterized by stealthy, multi-phase, and targeted attacks aimed at compromising information systems over an extended period. Develop-ing an effective Intrusion Detection System IDS capable of...
Towards Generalized Source Tracing for Codec-Based Deepfake Speech
Recent attempts at source tracing for codec-based deepfake speech CodecFake, generated by neural audio codec-based speech generation CoSG models, have exhibited suboptimal performance. However, how to train source tracing models using simulated CoSG data while maintaining strong performance on re...
A Systematic Literature Review on Continuous Integration and Deployment (CI/CD) for Secure Cloud Computing
As cloud environments become widespread, cybersecurity has emerged as a top priority across areas such as networks, communication, data privacy, response times, and availability. Various sectors, including industries, healthcare, and government, have recently faced cyberattacks targeting their...
Understanding the Error Sensitivity of Privacy-Aware Computing
Homomorphic Encryption HE enables secure computation on encrypted data without decryption, allowing a great opportunity for privacy-preserving computation. In particular, domains such as healthcare, finance, and government, where data privacy and security are of utmost importance, can benefit fro...
TokenBreak: Bypassing Text Classification Models through Token Manipulation
Natural Language Processing NLP models are used for text-related tasks such as classification and generation. To complete these tasks, input data is first tokenized from human-readable text into a format the model can understand, enabling it to make inferences and understand context. Text...
SoK: Data Reconstruction Attacks against Machine Learning Models: Definition, Metrics, and Benchmark
Data reconstruction attacks, which aim to recover the training dataset of a target model with limited access, have gained increasing attention in recent years. However, there is currently no consensus on a formal definition of data reconstruction attacks or appropriate evaluation metrics for...
Securing Unbounded Differential Privacy against Timing Attacks
Recent works have started to theoretically investigate how we can protect differentially private programs against timing attacks, by making the joint distribution the output and the runtime differentially private JOT-DP. However, the existing approaches to JOT-DP have some limitations, particular...
Data-Driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source Npm Packages
The npm Node Package Manager ecosystem is the most important package manager for JavaScript development with millions of users. Consequently, a plethora of earlier work investigated how vulnerability reporting, patch propagation, and in general detection as well as resolution of security issues i...
Profiling Electric Vehicles Via Early Charging Voltage Patterns
Electric Vehicles EVs are rapidly gaining adoption as a sustainable alternative to fuel-powered vehicles, making secure charging infrastructure essential. Despite traditional authentication protocols, recent results showed that attackers may steal energy through tailored relay attacks. One...
Distortion Search, a Web Search Privacy Heuristic
Search engines have vast technical capabilities to retain Internet search logs for each user and thus present major privacy vulnerabilities to both individuals and organizations in revealing user intent. Additionally, many of the web search privacy enhancing tools available today require that the...
How Good LLM-Generated Password Policies Are?
Generative AI technologies, particularly Large Language Models LLMs, are rapidly being adopted across industry, academia, and government sectors, owing to their remarkable capabilities in natural language processing. However, despite their strengths, the inconsistency and unpredictability of LLM...
Network Threat Detection: Addressing Class Imbalanced Data with Deep Forest
With the rapid expansion of Internet of Things IoT networks, detecting malicious traffic in real-time has become a critical cybersecurity challenge. This research addresses the detection challenges by presenting a comprehensive empirical analysis of machine learning techniques for malware detecti...
Private Memorization Editing: Turning Memorization into a Defense to Strengthen Data Privacy in Large Language Models
Large Language Models LLMs memorize, and thus, among huge amounts of uncontrolled data, may memorize Personally Identifiable Information PII, which should not be stored and, consequently, not leaked. In this paper, we introduce Private Memorization Editing PME, an approach for preventing private...
A Red Teaming Roadmap Towards System-Level Safety
Large Language Model LLM safeguards, which implement request refusals, have become a widely adopted mitigation strategy against misuse. At the intersection of adversarial machine learning and AI safety, safeguard red teaming has effectively identified critical vulnerabilities in state-of-the-art...
IF-GUIDE: Influence Function-Guided Detoxification of LLMs
We study how training data contributes to the emergence of toxic behaviors in large-language models. Most prior work on reducing model toxicity adopts $reactive$ approaches, such as fine-tuning pre-trained and potentially toxic models to align them with human values. In contrast, we propose a...
"Vcd2df" -- Leveraging Data Science Insights for Hardware Security Research
In this work, we hope to expand the universe of security practitioners of open-source hardware by creating a bridge from hardware design languages HDLs to data science languages like Python and R through novel libraries that convert VCD value change dump files into data frames, the expected input...
Doxing Via the Lens: Revealing Location-Related Privacy Leakage on Multi-Modal Large Reasoning Models
Recent advances in multi-modal large reasoning models MLRMs have shown significant ability to interpret complex visual content. While these models enable impressive reasoning capabilities, they also introduce novel and underexplored privacy risks. In this paper, we identify a novel category of...
WordPress Spreadsheet Price Changer 2.4.37 Privilege Escalation
WordPress Spreadsheet Price Changer plugin versions 2.4.37 and below suffer from a privilege escalation vulnerability...
Attacking Attention of Foundation Models Disrupts Downstream Tasks
Foundation models represent the most prominent and recent paradigm shift in artificial intelligence. Foundation models are large models, trained on broad data that deliver high accuracy in many downstream tasks, often without fine-tuning. For this reason, models such as CLIP , DINO or Vision...
Stark-Coleman Invariants and Quantum Lower Bounds: an Integrated Framework for Real Quadratic Fields
Class groups of real quadratic fields represent fundamental structures in algebraic number theory with significant computational implications. While Stark's conjecture establishes theoretical connections between special units and class group structures, explicit constructions have remained elusiv...
CAPAA: Classifier-Agnostic Projector-Based Adversarial Attack
Projector-based adversarial attack aims to project carefully designed light patterns i.e., adversarial projections onto scenes to deceive deep image classifiers. It has potential applications in privacy protection and the development of more robust classifiers. However, existing approaches...
Correlated Noise Mechanisms for Differentially Private Learning
This monograph explores the design and analysis of correlated noise mechanisms for differential privacy DP, focusing on their application to private training of AI and machine learning models via the core primitive of estimation of weighted prefix sums. While typical DP mechanisms inject...
LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges
The widespread adoption of Large Language Models LLMs has heightened concerns about their security, particularly their vulnerability to jailbreak attacks that leverage crafted prompts to generate malicious outputs. While prior research has been conducted on general security capabilities of LLMs,...
Are Trees Really Green? A Detection Approach of IoT Malware Attacks
Nowadays, the Internet of Things IoT is widely employed, and its usage is growing exponentially because it facilitates remote monitoring, predictive maintenance, and data-driven decision making, especially in the healthcare and industrial sectors. However, IoT devices remain vulnerable due to the...
Unraveling Ethereum'S Mempool: the Impact of Fee Fairness, Transaction Prioritization, and Consensus Efficiency
Ethereum's transaction pool mempool dynamics and fee market efficiency critically affect transaction inclusion, validator workload, and overall network performance. This research empirically analyzes gas price variations, mempool clearance rates, and block finalization times in Ethereum's...
Evaluating Explainable AI for Deep Learning-Based Network Intrusion Detection System Alert Classification
A Network Intrusion Detection System NIDS monitors networks for cyber attacks and other unwanted activities. However, NIDS solutions often generate an overwhelming number of alerts daily, making it challenging for analysts to prioritize high-priority threats. While deep learning models promise to...
LLM Unlearning Should Be Form-Independent
Large Language Model LLM unlearning aims to erase or suppress undesirable knowledge within the model, offering promise for controlling harmful or private information to prevent misuse. However, recent studies highlight its limited efficacy in real-world scenarios, hindering practical adoption. In...
Interpreting Agent Behaviors in Reinforcement-Learning-Based Cyber-Battle Simulation Platforms
We analyze two open source deep reinforcement learning agents submitted to the CAGE Challenge 2 cyber defense challenge, where each competitor submitted an agent to defend a simulated network against each of several provided rules-based attack agents. We demonstrate that one can gain...
Walrus: an Efficient Decentralized Storage Network
Decentralized storage systems face a fundamental trade-off between replication overhead, recovery efficiency, and security guarantees. Current approaches either rely on full replication, incurring substantial storage costs, or employ trivial erasure coding schemes that struggle with efficient...