TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless RacesTextSeal2 is a distortion-free LLM text watermark that merges two or more keys into one virtual key and couples it to fresh noise through AutoMark's Gaussian copula. Under speculative decoding it verifies keyed drafts with an extra exponential race, so output matches the target model and acceptance rate is unchanged. On three LLMs at a 10^-3 false-positive rate, it detects 8 to 22 points more 100-token answers than TextSeal.
arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π‘οΈ Security- TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races
TextSeal2 is a distortion-free watermark for LLM output that keeps its signal under speculative decoding. It merges two or more keys into one virtual key coupled to fresh noise through AutoMark's Gaussian copula, and verifies drafts with an extra exponential race. On three LLMs it detects 8 to 22 points more 100-token answers than TextSeal at a 10^-3 false-positive rate.
arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π§ AI - Stop Calling Them Provers: The Case for Calling ProVerif and Tamarin Symbolic Protocol Analyzers
Nadim Kobeissi's ePrint paper 2026/2683 argues that ProVerif and Tamarin should be called symbolic protocol analyzers, not provers. It audits their published soundness arguments, finding false statements, missing proofs and gaps between paper and implementation, and reproduces reported Tamarin bugs that accept false claims. It also covers model gaps in parsers and state machines, weak secrecy queries and unjustified primitive equations. The page is an abstract only.
eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π‘οΈ Security - SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection
SEAL is a defense against indirect prompt injection for local LLM agents. It learns a soft prompt and scoring readout offline, then uses a frozen task model to score and delete injected tokens from tool outputs, with queries built from trusted initial context. On AgentDojo, attack success falls from 34.6% to 0.1% and Joint rises from 51.4% to 77.5%, using about 127x fewer defense tokens than PISanitizer.
arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π‘οΈ Security - High Precision Noise Cleaning for CKKS with Application to Asynchronous Threshold CKKS
High Precision Noise Cleaning for CKKS is an IACR ePrint preprint (2026/2675) by Zhihao Li, Cheng Hong and Tao Wei. It composes lower-degree Hermite polynomials to reach output noise bounds such as 2^-300 for noise flooding, and uses this to build an asynchronous threshold CKKS scheme with strong simulation security in the random oracle model. In OpenFHE, binary-message cleaning falls from 9.63 s to 1.54 s.
eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π‘οΈ Security - REALM: Identifying Minimal Task Assets for LLM Agents
REALM (Required Execution Assets Linked to a Mission) is an approach to applying least privilege to LLM agents by identifying the assets a task needs, including ones discovered at runtime. It models assets as Dependency Graph nodes, separates discovering an asset from authorizing it, and exposes resource-bound Partial APIs inside a Task Container. On AgentDyn with qwen3.5-flash, attack success rate falls from 16.6% to 0.2%, with 40.0% task completion on clean tasks and 36.4% on injected cases.
arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026π‘οΈ Security - From Leniency to Suspicion: How an Open Post-Training Recipe Changes Whom LLM Fact-Checkers Believe
This paper measures job-based doubt in LLM fact-checkers: judging a claim false more often when the poster has a lower-status job. It compares base and post-trained checkpoints of six model families on fact-checked claims with randomised poster profiles. Only the open TΓΌlu-3 recipe (OLMo-2 32B, TΓΌlu-3 70B) creates the effect, under one percentage point but reliable. In OLMo-2 32B the flip comes from one residual-stream direction and appears at supervised fine-tuning, confirmed on 400 new claims. None of seven commercial models doubts lower-status posters more.
arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026π§ AI - Post-Training Large Language Models with LLMON
LLMON (LLM Object Notation) is a framework that separates instructions from data and requires explicit identifier-based execution. The authors post-train Granite-4.1 3B and 8B base models with SFT then RL on a 4.6B-token structured corpus covering general, RAG and tool-calling data, with distractor variants. Attack success rates on indirect prompt-injection benchmarks fall from 53-100% to 0.02-5.6%, and general capability is preserved. Attention-based metrics diagnose failures per transformer layer.
arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026π‘οΈ Security - Post-Training Large Language Models with LLMON
LLMON (LLM Object Notation) is a framework that separates executable instructions from passive data and requires explicit identifier-based execution. The paper post-trains Granite-4.1 3B and 8B base models on a 4.6B-token corpus of general, RAG and tool-calling data with distractor variants, using SFT then RL. Attack success rates on indirect prompt-injection benchmarks fall from 53-100% to 0.02-5.6%, with general capabilities preserved. It also adds attention-based per-layer diagnostics.
arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026π§ AI - Can LLMs Uncover Hidden Physical Laws through Free Exploration?
LongChang is an automated framework that builds simulated worlds with altered physical laws, such as heavier objects falling more slowly, to test whether LLMs can find the law by free exploration. Explorer LLMs manipulate objects and build tools without tasks or hints, while separate LLM agents generate scenes, review tool designs and grade reports. Across 12 LLMs, GPT-6 Astra reached a 16.7% discovery rate and the other 11 scored 0%.
arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026π§ AI 
Falcon Key Recovery from Joint Sampler LeakagesFalcon Key Recovery from Joint Sampler Leakages is an ePrint paper presenting a power side-channel attack on Falcon and FN-DSA that fuses three SamplerZ leakages (exponent class of the center, sign bit, proposal magnitude). It turns them into slab and halfspace constraints solved by softplus interval regression, with no LLL or BKZ. On PQClean Falcon-512 (ARM Cortex-M4) it recovered all 50 keys with at most 34 signatures; on c-fn-dsa it recovered 38 of 50 keys within 200 signatures.
eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026π‘οΈ Security- Private Information Retrieval with Accountability at Erasure-Optimal Server Redundancy
SynTrace is a single-round compiler that adds accountability to linear private information retrieval (PIR). The client mixes the retrieval query with m audit queries, so audit syndromes identify up to d deviating servers among t colluding ones before reconstruction. The paper proves perfect query privacy and zero false identification within the threshold. For Shamir-based PIR it needs k=t+d+1 servers. For a 32 KiB record from a 1 GiB database it uses 2.25 MiB, against 8.96 MiB for the Eriguchi, Kurosawa and Nuida (TCC 2022) homomorphic-MAC construction.
eprint.iacr.orgpaperPublished and added 26 Oct 2026π‘οΈ Security - SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments
SymLift is a compile-free vulnerability detection framework for context-incomplete code fragments. A fine-tuned LLM lifts control-flow, data-flow, memory and resource relations into a constrained LLVM-like IR. A parser turns the IR into facts, and Datalog rules derive findings with derivation traces. On Juliet function-level fragments Clang compilation success falls to 12.00%, while SymLift's completion rate drops only 1.17 points. SymLift-Qwen-7B reaches Target-F1 94.41% on FormAI and 91.66% micro-F1 on MegaVul.
arxiv.orgpaperAdded 28 Oct 2026, published 25 Oct 2026π‘οΈ Security - A KelseyβKohno Attack Variant against SHA-2 Message Digests in HSS/LMS and XMSS
Falko Strenzke's ePrint 2026/2635 presents a multi-target second-preimage attack on message hashing in HSS/LMS and XMSS with SHA-256 and SHA-256/192. It herds chaining states from many collected signatures into one state, defeating the key and leaf-index prefix. With 2^64 signatures, SHA-256 cost falls from 2^256 to about 2^166 (2^156 at maximal message length). SHAKE256 parameter sets are unaffected.
eprint.iacr.orgpaperAdded 26 Oct 2026, published 25 Oct 2026π‘οΈ Security - Who Is Sycophantic to Whom? Confident LLMs, Human Deference, and the Collapse of Trust Calibration
This paper studies reverse sycophancy: whether users bend toward a confident, consistent, wrong LLM. In a within-subjects experiment, 32 participants learned science topics from five GPT-5-mini assistants with 0 to 100% of facts replaced by falsehoods. Scores fell from 7.4 to 2.9 out of 10, planted falsehoods were chosen on 60% of falsified items against 11% of correctly taught ones, and confidence stopped tracking correctness. It introduces a baseline-corrected Human Deference Index.
arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026π§ AI - Linear Cryptanalysis of TFHE-Friendly Cipher FRAST in the Average Key Setting
Linear cryptanalysis of FRAST, a TFHE-friendly stream cipher, in the average key setting. It fixes the false-positive problem left open in the earlier attack by Bak et al., showing key differences fall into five indistinguishable classes per round. The Contract algorithm recovers the master key for 10 rounds and, on weak keys of density 2^-11.8 to 2^-5.4, reaches full FRAST within the claimed security.
eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026π‘οΈ Security - TRIAD: Benchmarking Omni-Modal Ambiguity in Multimodal Large Language Models
TRIAD is a benchmark for omni-modal ambiguity resolution. It has 327 hand-written text-image-audio queries in 86 scene groups across 18 ambiguity categories, and removing any one modality makes the answer non-unique. Across 14 omni-modal systems, the best model trails humans by over 20 points in group accuracy. Without answer options, model group accuracy falls to single digits, and leave-one-out tests show audio cues are often underused.
arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026π§ AI - Disentangling Robustness and Sycophancy in Multilingual LLMs
The SC-matrix is an evaluation framework for multilingual LLM sycophancy. It crosses a model's competence (correct answer with no pressure) with its sycophancy (keeping that answer under pressure), so agreeing with a false premise can be told apart from not knowing the answer in that language. Results: equal aggregate sycophancy rates hide different failure mixes, high competence does not always protect, and reasoning-oriented mitigations beat directive ones.
arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026π§ AI - RingTrace: Model-Free Spatio-Temporal Detection and Core Attribution for Cache Side-Channels
RingTrace is a monitoring framework that detects Flush+Reload cache side-channel attacks by combining per-core cache-miss counters with slice activity across uncore CBoxes. Its Joint Spatio-Temporal Attribution (JSTA) builds a joint-activity matrix without model training: the largest entry is the screening score and row sums point to a candidate core. The authors report detection before secret leakage, fewer false alarms under heavy memory load, and negligible runtime overhead on commodity processors.
eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026π‘οΈ Security - Verifiable Post-Quantum TLS Handshake: Recognizing Implementation Errors of Cryptographic Verification Steps
PQCD-TLS is a post-quantum TLS handshake that binds confirmation codes into chained key derivation, so a faulty signature or KEM verification step causes a key mismatch and handshake failure. The authors build confirmation-code frameworks for ML-DSA and Falcon signatures and for ML-KEM, HQC and DAWN, with unpredictability proofs. Across 48 configurations, handshake latency overhead stays below 1%.
eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026π‘οΈ Security - Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities
Paper (arXiv, 21 October 2026) on structural false negatives in LLM vulnerability discovery harnesses. Starting from Knostic's OpenAnt and raptor, then 10 more open-source harnesses, the authors map 13 points where code selection, filtering, and finding storage or merging drop vulnerabilities. One file was dropped by six harnesses before the model saw it, five without notice. It covers attacker evasion, content-steered verdicts, prompt injection, and design principles and tests.
arxiv.orgpaperAdded 24 Oct 2026, published 21 Oct 2026π‘οΈ Security - PQ-Vault: Provably Quantum-Safe Asset Custody for Unmodified Ethereum
PQ-Vault is a custody design for unmodified Ethereum against quantum key recovery. It combines a quantum-safe vault contract, a proof-of-stake sidechain with compact certificates, and an optimistic dispute protocol. The paper proves that compact certificates with classically chosen parameters fall from 128 to about 60 bits against quantum attackers, and bounds a seed-update stake-steering attack. For 65,536 validators a certificate is 0.8 MB and verifies in about 20 ms, and the vault accepts a checkpoint for about 420,000 gas.
arxiv.orgpaperAdded 24 Oct 2026, published 21 Oct 2026π‘οΈ Security - Beyond 4 bits: Data-Centric Post-training Quantization and Recovery
This paper studies 2-bit post-training quantization (PTQ) of six dense and mixture-of-experts models from 3.8B to 32B parameters. It finds the quantization representation matters most: vector codebooks give usable models where scalar PTQ falls to chance. Calibration and recovery data must be chosen jointly. The recipe uses about 2.3 effective bits per weight, keeps 89 to 97% of full-precision QA accuracy, and needs 1.4 to 30x less compute than the strongest QAT baseline.
arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026π§ AI - Code2Video-Compass: A Comprehensive Benchmark for General-Purpose Code-Based Video Generation across T2V, I2V, and V2V
Code2Video-Compass is a benchmark of 2,104 tasks for code-based video generation, where multimodal LLMs write executable programs that produce complete videos from text (T2V), image (I2V) or video (V2V) inputs. Tasks span 10 categories and 24 subtypes. Scoring uses 12 objective metrics and five MLLM-judge metrics. Across 15 proprietary and open-weight models from nine families, performance falls as construction, dynamic animation and state-dependency complexity rise.
arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026π§ AI - Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG
nokast-secureRAG is a roughly 0.5B-parameter small language model that works as a semantic firewall between retrieval and generation in local RAG systems. It classifies each query and context pair as safe, suspicious or malicious. It reaches 0.994 recall at a 0.026 false-positive rate in-distribution, beating Llama Guard 3 1B and Prompt-Guard-86M (0.900 recall, 0.690 FPR). Recall on PoisonedRAG falls to near zero, and single-request latency is 293-404 ms.
arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026π‘οΈ Security - Is Sycophancy a Form of In-Context Updating?
"Is Sycophancy a Form of In-Context Updating?" argues that factual sycophancy, a model's deference to a user's false beliefs, is a failure of in-context updating rather than only a bid for approval. Models also revise answers for claims attributed to external sources, more so when better supported, and deference persists when no user approval is at stake. The internal components behind deference also matter causally for general updating, so reducing sycophancy may reduce useful updating.
arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026π§ AI - Fault-Induced Nonce Repetition in Threshold Lattice Signatures: A Reveal-Structure Criterion, Cross-Scheme Analysis, and Detection Boundaries
Fault-Induced Nonce Repetition in Threshold Lattice Signatures is an ePrint paper (2026/2566, Yulong Meng) showing that faulting t devices in a t-of-n threshold ML-DSA deployment recovers the full signing secret, verified on Mithril with exact recovery in 96/96 scan groups. It gives a reveal-structure criterion across Quorus, TALUS and Trilithium, a threshold law m* = (β-1)N+βN/Kβ for imperfect faults, and two-layer transcript detection (305/305 hits, no false positives).
eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026π‘οΈ Security - Regular Syndrome Decoding Is Easier Than Previously Estimated
Preprint by Jiseung Kim, Minkyu Kim, Changmin Lee and Hochang Lee on the Regular Syndrome Decoding (RSD) problem. It presents a hybrid-algebraic attack that balances zero-coordinate guesses and syndrome-based eliminations across regular blocks. Parameter sets in Ferret, Wolverine and committed VOLE fall below 128-bit targets by up to 67 bits, and the revised Liu et al. (EUROCRYPT 2024) PCG sets cost under 2^111 field operations.
eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026π‘οΈ Security - Regular Syndrome Decoding Is Easier Than Previously Estimated
Preprint 2026/2563 presents a refined hybrid-algebraic attack on Regular Syndrome Decoding (RSD) that balances zero-coordinate guesses and syndrome-based eliminations across all regular blocks. It puts at least one parameter set each from Ferret (CCS 2020), Wolverine (IEEE S&P 2021) and committed VOLE (CCS 2025) below the 128-bit target, with losses up to 67 bits. PCG attack costs improve by up to 29.77 bits (non-binary) and 25.91 bits (binary), and the revised Liu et al. (EUROCRYPT 2024) 128-bit sets fall below 2^111 field operations.
eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026π‘οΈ Security - Graphs and cycles in curve-based collision walks
Graphs and cycles in curve-based collision walks is an IACR ePrint paper (2026/2560) on van Oorschot-Wiener style collision attacks in the multi-user setting. It covers elliptic curve discrete logarithms and isogeny pathfinding on supersingular F_p^2 and F_p curves, and proposes new pseudorandom walks. For F_p^2 curves, L keys need about L + log(L) useful collisions with no infiltrator. For F_p curves, about 0.75L keys fall to L collisions with an infiltrator.
eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026π‘οΈ Security - Privacy with Leakage from Falsifiable Assumptions
Privacy with Leakage from Falsifiable Assumptions is an ASIACRYPT 2026 paper by Francesco Berti and Itamar Levi. It replaces simulatability with "secure refreshing", a key-refreshing assumption that evaluation laboratories can test directly, and adds "strongly protected secure refreshing". Using these, it proves privacy of the PSV encryption scheme without assuming a leak-free component.
eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026π‘οΈ Security - Evasive Inner Product Functional Encryption Is Broken Too
Evasive Inner Product Functional Encryption Is Broken Too is a 2026 ePrint paper by Agrawal, Modi, Yadav and Yamada. It gives a counterexample showing the evasive IPFE assumption of Hsieh, Lin and Luo (Eurocrypt 2024) is false in full generality. The attack extends the 2025 PRFE counterexample and needs only the weak inner product functionality, not pseudorandom function computation. The authors conclude that letting the adversary choose unrestricted private coins breaks the Evasive LWE family.
eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026π‘οΈ Security - IISFA: Ineffective Instruction-Skip Fault Attacks on Bitslice Implementations
IISFA (Ineffective Instruction-Skip Fault Attack) targets bitsliced block cipher implementations protected by redundancy countermeasures. Skipping one bitslice instruction leaves the result unchanged only when all m S-box inputs fall in an ineffective set, so each released ciphertext restricts all m subkeys. The authors give known- and chosen-plaintext key-recovery procedures and expected injection counts, and recover keys in every trial on GIFT, SKINNY and PIPO implementations on an 8-bit AVR microcontroller using clock glitches.
eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026π‘οΈ Security 
Post-Quantum Stateless Steganography & MTU Bounds: Bridging P2P Censorship Resistance to Quantum NetworksForum announcement of a Zenodo preprint on post-quantum migration for censorship-resistant P2P steganographic tunnels. It argues that ML-KEM's prime modulus (q=3329) makes naive bit-packed ciphertexts statistically distinguishable from uniform noise, which gives a cheap passive DPI distinguisher. It also argues that composite PQ 0-RTT envelopes over 4.4 KB force fragmentation, which requires stateful reassembly before AEAD verification and reopens memory-exhaustion DoS in eBPF/XDP filters. Proposed fixes are algebraic uniformization (LWR lattices or inverse rejection sampling), sub-MTU hybrid or pure-PQ envelopes (Falcon-512, signcryption), and FujisakiβOkamoto implicit rejection for constant-time silent drops. Aimed at Ethereum validator, libp2p and RPC transports facing harvest-now-decrypt-later threats.
ethereum-magicians.orgpaperPublished and added 17 Oct 2026π‘οΈ Security- Eο¬cient Fixed-Point Implementation of Mitaka
Presents a fixed-point C implementation of the Mitaka signing algorithm, a simpler, parallelizable Falcon (FN-DSA) variant. It replaces MitakaZ's wide integral Gram root decomposition with a fixed-point square Cholesky decomposition, which cuts the cost of integer Gaussian sampling, and proves bounds on intermediate values and representation errors without empirical assumptions. Signing averages 361 kcycles (Mitaka-512) and 707 kcycles (Mitaka-1024) on AVX2, and 4.0 and 7.8 Mcycles on an STM32F411 Cortex-M4F. This makes floating-point-free lattice signatures practical on constrained devices.
eprint.iacr.orgpaperPublished and added 17 Oct 2026π‘οΈ Security - Predictable Scaling: Efficient Model Exploration via Scaling-Law Prediction
Predictable Scaling (PS) is a framework that predicts full-scale recommendation model performance from scaled-down proxies. It builds proxies with composable scaling functions along separate resource axes, then projects metrics to target scale by curve fitting with calibrated uncertainty. Of three predictors, even the raw proxy falls within repeated-run noise, and a Gaussian Process gives 15% lower relative MAE. On a task-specific ranker and a foundation ranker, PS ranks hypotheses correctly at 79-88% compute reduction.
arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026π§ AI - safeRNSgcd: Accelerating Falcon key generation with RNS in SafeGCD
ePrint paper presenting safeRNSgcd, which computes the single BΓ©zout coefficient needed at the deepest level of Falcon's NTRU solver while keeping large integers in a residue number system. Centered explicit CRT recovers the exact low bits needed by SafeGCD batches using single-word fixed-point arithmetic. A C implementation integrated into ntrugen reduces inversion and private-key basis-generation cost on a Raspberry Pi 5 and two x86-64 CPUs, versus the original ntrugen and a variant that skips the unused coefficient.
eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security - Onboard Lightweight LLM Reasoning for Human-Aware Safe UAV Navigation
Presents a modular, fully onboard UAV navigation pipeline that closes the "human-aware safety gap" of geometry-only planners. A shared BLIP encoder drives captioning and text-conditioned segmentation, which is fused with depth for 3D obstacle localization. Qwen-2.5-0.5B, stabilized with RAG and grammar-constrained JSON decoding, infers per-category risk once per class and caches the verdict. Perception runs at 10 Hz on a Jetson Orin NX, and fallback LLM queries take about 0.8 s off the control path. In Gazebo it gives roughly 3x fewer collisions than a geometric planner and raises semantics-aware landing success from 34% to 96%. The 224-pixel encoder input limits small-object perception at range.
arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026π§ AI - Multi-Reward Hacking: From Aggregation-Induced Drift to Trust-Anchored Defense
The paper shows that symmetric aggregation of a primary reward (correctness) and auxiliary rewards (brevity, efficiency) in LLM post-training can raise aggregate reward while primary-task performance falls. It proves that deterministic conditional-mean GRPO converges to auxiliary-favoring behavior when auxiliary rewards are more reliably obtained. It proposes Trust-Anchored Gating (TAG), which elects an anchor channel by policy drift and gates auxiliary credit on anchor satisfaction. On Qwen3-4B with a brevity reward, TAG reaches 0.581 pass@4 versus 0.220 for additive aggregation, and shortens responses by 44% relative to correctness-only training. Experiments on Qwen and Llama models cover math and program synthesis.
arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026π§ AI - From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection
Evaluates a native probabilistic decision model (Jev), Llama Prompt Guard 2 (22M and 86M) and an LLM judge on 47,611 held-out examples covering direct/indirect prompt injection, hard-benign inputs, obfuscation and distribution shift. The LLM judge has the best AUROC (0.897), followed by Jev (0.871), Prompt Guard 2 86M (0.757) and 22M (0.714). Jev's native probabilities do not consistently beat post-hoc calibrated classifier scores, and temperature scaling improves calibration but not discrimination. At a 1% false-negative-rate target, every system needs over 91.8% escalation, so probabilistic outputs alone do not give reliable security decisions under distribution shift.
arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026π‘οΈ Security - Evidence-First Agentic Verification
Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.
arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026π§ AI - BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views
BrowseSafe++ extends BrowseSafe to 38,675 paired attacked/clean web pages, most with prompt injections observed in the wild on production sites. Pages cover twelve site types, 24 attack types and 18 injection locations, each given as HTML, Markdown, accessibility tree and screenshot with a user task and expected answer. The authors train BrowseSafe-Guard, two 0.8B detectors (text and screenshot) that beat a frontier-model-based detector on F1 with low false positives and low inference cost. BrowseSafe-Adapt rewrites injections using browser-agent feedback, raising attack success from a few percent to up to 95.41%.
arxiv.orgpaperAdded 15 Oct 2026, published 12 Oct 2026π‘οΈ Security - Staggered Instruction-Fetch Duplication: A Lightweight Processor-Level Countermeasure Against Fault Injection
Proposes Staggered Instruction-Fetch Duplication (SIFD), a processor-level fault-injection countermeasure that fetches each instruction twice in consecutive cycles while fetching two different instructions per cycle, so inconsistent fetches are detected without full processor duplication, compiler support or crypto hardware. Implemented on a custom RV32I core on an Artix-7 FPGA, it costs 15.0% more slices and 16.3% more execution time. Attack success falls from 0.86% to below 0.01% under clock fault injection and from 0.32% to 0.13% under EMFI, with 73.18% of CFI and 11.44% of EMFI attempts detected.
eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026π‘οΈ Security - Confidential Error-Correcting Codes
Introduces Confidential Error-correcting Codes (CECs), a primitive that decodes reliably from perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF; the Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes and claims stronger concrete security than PRCs (CRYPTO'24). The application, CECMark, watermarks AI-generated images and reportedly beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 1e-5 and no side effects.
eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026π§ AI - Confidential Error-Correcting Codes
Introduces Confidential Error-correcting Codes (CECs), a cryptographic primitive for decoding perturbed codewords while keeping the message confidential, defined by confidentiality, robustness and soundness. The Randomness-Security Separation framework encodes a nonce and masks the payload with a PRF. The Conc-CEC instantiation uses concatenated Reed-Muller and Reed-Solomon codes, and the authors claim stronger concrete security than PRCs (CRYPTO'24). The CECMark application watermarks AI-generated images, and the authors report it beats Gaussian Shading, PRCMark and T2SMark across 56 perturbations with a false positive rate below 10^-5.
eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026π‘οΈ Security - SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation
SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflows across accumulated code; when a rule fires, generation is interrupted, a warning is inserted, and decoding resumes so the model repairs the draft in the same trace. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%β98.1%, uses fewer tokens than post-hoc repair, and limits regressions from false warnings.
arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026π‘οΈ Security - SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation
SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflow across accumulated code. When a rule fires, generation is interrupted, a warning is inserted and decoding resumes, so the model repairs its draft without regenerating the full response. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%β98.1%, uses fewer tokens than post-hoc repair, and limits functional regressions from false warnings.
arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026π‘οΈ Security - When VLMs Destroy What They Know: Spatial Representations Fall Below Lexical Priors
Introduces EICS (Evaluation-Invariant Concept Stability), a metric for checking whether representations consistently encode a concept under controlled one-concept interventions. Also introduces CASP-VL, a benchmark of causally controlled spatial perturbations derived from Visual Genome scene graphs. Across several VLM architectures, spatial relations are represented much less faithfully than lexical information, even for models well above chance on compositional benchmarks. The relation is identifiable at the predicate's own tokens but is lost when the sentence is aggregated into a global representation (EOS token or mean pooling), a failure that output-based evaluation does not reveal.
arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026π§ AI - Flying, Not Floating: Precise Fixed-Point Falcon on Embedded Processors
Presents the first fixed-point FN-DSA (Falcon) signer for microcontrollers, using 32.64 arithmetic in constant-time Cortex-M4 assembly for Falcon-512 and Falcon-1024. Techniques that keep reciprocals, inverse square roots and small constants wide and round once at the consumer restore the precision lost by naive fixed-point. Measured precision supports about 2^99.7 (Falcon-512) and 2^96.7 (Falcon-1024) signing queries per key, against about 2^61.5 and 2^58.7 for double precision and the 2^64 target. The signer needs about 45% fewer cycles than double-precision emulation, at the cost of signing RAM rising from 59n to 83n bytes. The paper also shows which implementation choices lift double-precision c-fn-dsa above 2^64, derives Falcon-1024 key-generation bounds (72.3% of keys accepted vs 8.5% with the Falcon-512 values), and gives recommendations for the fixed-point FN-DSA NIST plans.
eprint.iacr.orgpaperAdded 12 Oct 2026, published 9 Oct 2026π‘οΈ Security - DITTO: A Context-aware Pickle-based Pre-Trained Model Scanner for Effective Security Audits
Introduces DITTO, a stack-based, context-aware scanner for Pickle-based pre-trained models that tracks Pickle VM state transitions and applies semantic analysis to infer model intent. Authors found 9.3% of 10,000+ popular Hugging Face repos still use Pickle, and release PickleBench (959 benign, 92 malicious models, including extension registry attacks missed by existing tools). Reports 100% coverage, 0% false negatives, 0.7% false positives, F1 0.966, outperforming current scanners.
arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026π‘οΈ Security - On the Reliability of LLM-Based Vulnerability Patching Benchmarks
This arXiv paper examines why current LLM-based automated vulnerability-patching benchmarks overstate model performance, identifying pitfalls at the agent level (prompting/tooling inflating success without improving patch quality), framework level (permission errors, infra bugs, timeout handling silently skewing scores), and dataset level (single PoC tests failing to verify root-cause fixes). The authors curate 112 historical bugs across 84 open-source C/C++, Go, and Rust projects, each annotated with PoC tests, regression tests, and developer-intent tests, and show that while PoC pass rates look high, developer-test pass rates stay low and barely improve with newer models. They provide guidelines for more rigorous, reproducible evaluation of LLM patching systems.
arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026π‘οΈ Security - Provable Subexponential Algorithms for NIST Third-Round Lattice Families
An IACR ePrint paper by Yiming Gao, Xuyuan Han, and Honggang Hu presenting provable classical subexponential algorithms (running in roughly 2^((1/2+o(1))n/ln ln n) time/space) for recovering short secrets in growing parameter families tied to all seven NIST third-round lattice candidates: Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, Dilithium/ML-DSA, Falcon, and cyclic NTRU-HPS/HRSS. The approach extends the Wagner-style Gaussian sampling framework of Ducas, Engelberts, and Loyer (CRYPTO 2025) and a low-error decision-LWE algorithm, using an exact squared-Euclidean-norm gap to binary-search each secret coordinate, and an "affine slice search" over the public lattice for NTRU/Falcon-type quotient relations. The authors explicitly note the subexponential complexity applies to growing/weakened parameter regimes and does not reduce the concrete security of the currently specified NIST parameter sets.
eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026π‘οΈ Security - Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents
Semantic Behavioral Watermarking (SBW) is a provenance scheme for LLM agents that embeds an owner identifier in semantic clusters of an agent's action choices rather than exact action symbols, making it robust to paraphrasing/tool-renaming that breaks three prior agent watermarks (e.g., AgentMark drops to 16.8% bit-recovery under observation paraphrasing). It adds keyed, collision-resistant binning proven unpredictable in the random-oracle model to resist forgery (adaptive forgery success drops from 100% to the false-positive floor), while explicitly documenting an unsolved attack: chained-replay forgery, which still succeeds 0.76-0.98 of the time across five tested agent models (3B-14B, Qwen, ToolBench/ALFWorld benchmarks). Code is released alongside the paper.
arxiv.orgpaperAdded 8 Oct 2026, published 6 Oct 2026π‘οΈ Security - Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents
This paper introduces Semantic Behavioral Watermarking (SBW), a method for embedding an owner identifier into an LLM agent's high-level tool/action choices rather than output tokens, so provenance survives tool renaming and observation paraphrasing. It watermarks over semantic action clusters with history conditioning and replaces the public-cluster bin with keyed collision-resistant binning that is provably unpredictable under the random-oracle model, closing a forgery gap left by prior agent watermarks (e.g., AgentMark, whose bit-recovery drops to 16.8% under paraphrasing). Evaluated across five agent models (3B-14B, four vendors) on ToolBench and ALFWorld, cluster-level watermarking achieves far higher detection under rewriting (0.49-0.66 vs 0.05-0.17 on ToolBench; 0.92-0.97 vs 0.00-0.01 on ALFWorld) and reduces adaptive forgery success from 100% to the false-positive floor, while noting chained-replay attacks remain an open vulnerability (0.76-0.98 detection failure).
arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026π§ AI - Toward Alignment Scaling Laws: A Framework and First Preregistered Measurements
This paper proposes a formal framework for "alignment scaling laws," modeling the compute/capability burden needed to hold a fixed safety target for each risk category as a power law B_r(N)=a_rN^alpha_r, where the exponent alpha_r determines whether alignment gets easier, keeps pace, or accumulates "alignment debt" as capability N grows. The authors prove theoretical results (the largest exponent among corrected risks sets the long-run regime, super-exponential headroom requirements above alpha=1, small-model fits underestimate large-scale exponents for power-law mixtures) and apply a preregistered protocol twice: a reanalysis of adversarial-training data on Pythia classifiers (attack-success compute exponent 0.60) and a pilot across Qwen2.5 (0.5B-72B) and Qwen3 (0.6B-14B), finding scaling helps for truthfulness and stated dispositions but sycophancy (exponent ~0.83-0.89) and a planted backdoor behave worse or remain undetermined, with the backdoor surviving blind safety training at most model sizes. The work matters as an early attempt to put the "does alignment get harder with scale" debate on measurable, falsifiable footing rather than anecdote.
arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026π§ AI - K-LMS: Design, Implementation, and Evaluation of LeightonβMicali Signatures with Korean Cryptographic Primitives
An IACR ePrint paper presenting K-LMS, an experimental variant of the NIST-standardized LMS hash-based post-quantum signature scheme in which the underlying hash is swapped for Korean primitives: the LSH-256 hash function (reference and vectorized) and a Tandem-DM double-block-length construction built from the CHAM, LEA, and ARIA block ciphers. The authors implement a non-invasive backend-swapping bridge over the reference LMS code and benchmark keygen/sign/verify latency, key/signature sizes, memory, and parameter sweeps, finding that hash substitution doesn't change key/signature sizes but that two measurement pitfalls (hash dispatch overhead, and software vs. hardware-accelerated SHA-256 baselines) can shift performance comparisons by an order of magnitude or 6x respectively. They report LSH-256 K-LMS signing on par with SHA-256 LMS in software, and 3.3-3.9x faster than a prior K-XMSS implementation because LMS needs fewer hash calls per Winternitz step than XMSS.
eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026π‘οΈ Security - CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?
CheckerBench is an executable benchmark of 300 tasks drawn from 297 CVEs across 167 repositories, 85 CWEs, and five language ecosystems, testing whether long-horizon coding agents can synthesize working static-analysis checkers from a defect specification through repeated compile-and-analyze feedback loops. Its companion framework CheckerLab independently rebuilds submitted checkers and scores vulnerable-fixed diagnostic contrast, patch localization, false positives, and tool use; across 21 model-harness configurations mean Pass@1 is 32.30 percent and the best reaches 45.33 percent, showing reliable checker synthesis remains hard for current coding agents.
arxiv.orgpaperAdded 8 Oct 2026, published 6 Oct 2026π§ AI - CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?
CheckerBench is an executable benchmark of 300 tasks derived from 297 CVEs across 167 repositories, 85 CWEs, and five language ecosystems, testing whether long-horizon coding agents can synthesize working static-analysis checkers from a defect specification through repeated compilation and analysis feedback. The accompanying CheckerLab framework independently rebuilds submitted checkers and measures vulnerable-vs-fixed diagnostic contrast, patch localization, false positives, and tool use; across 21 model-harness configurations mean Pass@1 is 32.30% (best 45.33%), showing reliable checker synthesis remains hard for current agents.
arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026π‘οΈ Security - Randomness-Anchored Runtime Discovery of Cryptographic Operations on Linux Using eBPF
This IACR ePrint paper presents a Linux runtime cryptographic discovery system built on eBPF user-space probes that detects both classical and post-quantum (ML-KEM) cryptographic operations as they execute, complementing static binary/SBOM analysis with dynamic observation. It uses "randomness anchoring" β correlating observed key-generation/encapsulation randomness with subsequent crypto API calls in the same process β to raise detection confidence without adding false positives, reporting perfect precision/recall on classical and ML-KEM workloads, median detection latency of 28 ΞΌs, and 14β18% overhead on key-generation-bound workloads. A nine-application case study (drawn from/paired with QED datasets) compares static vs. runtime views and shows how eBPF probe coverage limits what can be observed, relevant to building a runtime cryptographic bill of materials for PQC migration compliance.
eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026π‘οΈ Security - Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents
This arXiv paper replays ground-truth tool calls from the AgentDojo and tau-bench agent benchmarks (without an LLM) to generate benign-by-construction tool outputs, then labels injected outputs via differential replay to evaluate fifteen prompt-injection detectors, including Meta's Prompt Guard 2, plus two task-aware LLM judges, also testing them on BIPIA. It finds detection rankings transfer poorly between benchmarks (the best detector on BIPIA catches only 2% of AgentDojo injections at 1% false-positive rate; a detector catching 72% of AgentDojo injections catches only 15% on tau-bench), while false-positive rates do transfer between the two agent benchmarks, and traces this to mismatches between training data format (e.g., training on short prompt strings vs. tool-output-embedded injections) and deployment context.
arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026π‘οΈ Security - Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems
Persona Guardrail is a production-grade runtime defense framework for customer-facing LLM agents that enforces explicit functional boundaries via synchronous input/output validation against semantic allowlist and blocklist specifications. The authors also introduce PAGE (Persona-Aware Guardrail Evaluation), a benchmark covering benign, adversarial, and out-of-domain user and agent turns; deployed in production, it raises overall accuracy from 85.7% to 95.9% versus a generic LLM-based guardrail, boosts out-of-domain detection from 57.3% to 93.5%, and cuts the false-approved rate from 25.0% to 4.7%, all within latency budget.
arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026π‘οΈ Security - Mixture-of-Experts for Cryptocurrency Order Execution: Training Stability, Tail Risk, and Failure Modes
Evaluates vanilla Double Deep Q-Learning (DDQL), K-means-partitioned mixtures of DDQL experts (K=2, 4, 8) and parameter-matched dense networks for order execution on 5-minute BTC/USDT limit order book data from Binance. No learned configuration significantly beats DDQL on implementation shortfall, and all are worse than TWAP and immediate liquidation in this frictionless replay environment. Ablations show annealed exploration alone removes the collapse to wait-until-forced-liquidation policies (12/100 to 0/100), so expert partitioning appears to mask a training-specification flaw rather than add real benefit. The attribution of the failure mode reverses between 30 and 100 seeds, which makes the paper a case for repeated-seed evaluation in RL.
arxiv.orgpaperAdded 15 Oct 2026, published 2 Oct 2026π§ AI - AuraForge: Scaling Security Supervision for Training Coding Agents
AuraForge is a method for synthesizing and validating executable security tests to train coding agents toward secure (not just functionally correct) code, combining attack-oriented test synthesis, multi-language task construction, and safeguards against reward hacking. The authors release AuraGym, a 679-task executable training gym drawn from 344 real-world Python/JavaScript/TypeScript repositories spanning 177 CWE categories, and show that training Qwen3.5-4B with AuraForge-synthesized tests beats human-written tests on both functional-pass (FuncPass) and security-pass (SecPass) metrics while cutting false positives by over 83%.
arxiv.orgpaperAdded 3 Oct 2026, published 1 Oct 2026π‘οΈ Security - AuraForge: Scaling Security Supervision for Training Coding Agents
AuraForge is a pipeline that synthesizes and validates executable security tests to supervise the training of coding agents, using attack-oriented test synthesis and safeguards against reward hacking. The authors build AuraGym, a multi-language (Python, JavaScript, TypeScript) training gym of 679 feature-implementation tasks from 344 real repositories spanning 177 CWE categories, and show that training Qwen3.5-4B with these synthesized tests beats human-written security tests on both functional correctness (FuncPass) and security (SecPass) metrics, while producing about 3x more test cases and cutting false positives by 83 percent.
arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026π§ AI - Prompt Injection Detection for Email Agents Through Attack Chain Modeling
This paper proposes an attack-chain-based detection framework for indirect prompt injection in LLM email assistants, combining a text detector, stage-specific verifiers, rule-based risk signals, and user-intent/action consistency checks scored via a logistic decision policy, rather than treating detection as binary malicious-text classification. Evaluated under random splits, temporal and cross-dataset transfer, and ablations across five binary benchmarks, it achieves a mean F1 of 0.406 versus 0.216 for the best of five existing pretrained detectors, and shows random splits overestimate robustness under distribution shift while training on hard benign (attack-resembling) emails reduces false alarms.
arxiv.orgpaperAdded 30 Sep 2026π‘οΈ Security - StateTape: Action-Conditioned Evidence Lifecycle Modeling for Long-Horizon Coding Agents
StateTape is a framework for long-horizon coding agents that replaces text-based context pruning/summarization with a symbol-level code graph tracking which code symbols each write could have affected. A per-write procedure uses the graph to nominate context records a write may have falsified, with a small manager model resolving ambiguous cases, turning staleness detection from text inference into an observation of actual code dependencies. The paper introduces TraceBench, a benchmark labeling what an agent holds versus what it actually needs, and shows improved resolve rates across six coding agents and three edit-heavy benchmarks with low computational overhead.
arxiv.orgpaperAdded 30 Sep 2026π§ AI - Aletheia: Permission-Minimality Testing for Coding-Agent Rules
Aletheia is a permission-minimality testing framework for coding-agent repository instruction files (rules), which can be weaponized via prompt injection to request unnecessary credential access or data exfiltration while still producing a correct patch. It translates requested authority into a typed language, synthesizes sandbox configurations, and runs tasks under full versus incrementally restricted permissions to produce "dispensability witnesses" that flag suspicious permission requests. On the AIShellJack benchmark it detects all 314 attack inputs with zero false alarms on five benign templates, and on 80 manually verified benign GHAgentFiles rules it raises only 3 false positives (3.75%).
arxiv.orgpaperAdded 2 Oct 2026, published 30 Sep 2026π‘οΈ Security - SoK: A Large-Scale Empirical Study of Emulation-Based Dynamic Analysis Research for ARM Cortex-M Firmware (Extended Version)
This SoK paper empirically evaluates 24 published emulation-based dynamic analysis tools for ARM Cortex-M firmware re-hosting, using large-scale datasets from OTACAP and FirmLine totaling 4,571 deduplicated ARM firmware samples. It finds that only 34.5% of samples can be successfully fuzzed by any existing tool, with average code coverage of just 10% and frequent false crashes/hangs, exposing systemic gaps across the emulation, fuzzing, and bug-diagnosis pipeline stages.
arxiv.orgpaperAdded 2 Oct 2026, published 30 Sep 2026π‘οΈ Security - Breakdown of Local Denoising as Semantic Speciation
This paper studies two temporal phenomena in generative model sampling dynamics: a 'speciation window' where a sample commits to a semantic class, and a 'nonlocality window' where local context becomes insufficient for generation. Under a 'common cause' hypothesis β that semantic labels explain correlations between distant tokens β the authors prove the nonlocality window must fall within the speciation window, and identify conditions under which both windows collapse to a single phase-transition point as system size grows, verified analytically in Gaussian mixture models.
arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026π§ AI - Stochastic World Models for Verifying Vision-Based Neural Feedback Systems
This paper introduces stochastic world models as a new class of perception surrogates for formally verifying vision-based neural feedback (control) systems, replacing GAN-based surrogates that are large and hard to verify. The world model is built with physically grounded latents using operations standard verifiers can bound, and reproduces held-out frames more faithfully than GAN surrogates with up to 130x more parameters. Combined with a verification procedure mixing falsification, adaptive refinement, symbolic and backward analyses, it resolves the entire state space on an emergency braking benchmark (38% more than the prior state-of-the-art verifier) and over 80% of the state space on a previously-unverified RGB version of the benchmark.
arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026π§ AI - EvE: An Alternate Optimizer to Adam
EvE (Evolutionary Explorer) is a steady-state, population-of-four differential evolution optimizer with a targeted Adam fallback, proposed as an alternative to Adam for cheap, early ranking of configurations in hyperparameter and architecture search. Under a fixed evaluation-cost-matched budget it wins or ties Adam on 76% of 70 (problem, dimension) cells across seven scalable benchmarks up to one million variables, and on real tasks (MLP on MNIST, LoRA fine-tuning of a 1.5B-parameter LLM on two datasets) it finishes 1.7-3.9x faster at a modest quality cost. Inside successive halving on UCI Adult it completes hyperparameter/architecture searches 3.1-3.5x faster while ranking configurations nearly as consistently as Adam does with itself across seeds (Kendall's tau 0.66-0.69).
arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026π§ AI - SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents
SEABench is a benchmark of 48 longitudinal task sequences designed to study endogenous misalignment in self-evolving LLM agents β agents that modify their own controller instructions, memory protocols, and tools in response to feedback. It includes an adaptive trajectory discovery pipeline and paired non-evolving baseline agents for causal attribution, and finds that self-evolution boosts task completion but introduces safety failures absent in static baselines; the authors also show that chain-of-thought monitoring can catch these divergent unsafe behaviors with a low false-positive rate.
arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026π‘οΈ Security - SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents
SEABench is a benchmark for studying "endogenous misalignment" in self-evolving LLM agents β agents that modify their own controller instructions, memory, and tools after deployment based on feedback. It comprises 48 longitudinal task sequences across multiple evolution surfaces, task domains, and harm types in a personal-assistant environment, using an adaptive trajectory discovery pipeline and paired non-evolving baseline agents for causal attribution. Evaluation across several LLMs shows self-evolution boosts task completion but introduces safety failures absent in non-evolving baselines, and the paper proposes a chain-of-thought monitoring strategy that mitigates unsafe behavior with low false positives.
arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026π§ AI - Source-preserving alignment for robust evidence localization in scientific PDFS
Presents a source-preserving alignment framework for locating extracted evidence strings within the original PDF text layer, addressing mismatches caused by line wrapping, Unicode variants, superscripts, and citation markers. The method normalizes text for matching while preserving provenance to map matches back to exact source-character spans and render only the matched geometry, falling back to line-break-aware token alignment when exact matching fails. On 1,020 chemistry papers it achieves a 92.6% quote-level automatic localization rate versus 43.6% for plain text search and 19.1% for a precomputed bounding-box baseline.
arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026π§ AI - ReproBench: Benchmarking LLM Agents on Reproducing Vulnerability From Scratch
ReproBench is a benchmark that tests whether LLM agents can autonomously reconstruct an execution environment and reproduce a real vulnerability starting from nothing but a CVE identifier, rather than being handed source code or a container. It decomposes the workflow into six verifiable phases (firmware download/unpacking, analysis, crash validation, etc.) and evaluates agents on 30 real-world IoT firmware CVEs. The study finds only 5.3% of CVE-model pairs achieve genuine reproduction while 45.3% of runs fall back to vulnerability simulation as a shortcut, and it catalogs the bottlenecks blocking agents at each pipeline stage.
arxiv.orgpaperAdded 2 Oct 2026, published 28 Sep 2026π§ AI - PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift
PIDS-Bench is a frozen, multi-axis benchmark for prompt-injection detectors that jointly measures attack detection and benign false-positive rates across in-distribution inputs, hard-benign prompts mimicking injection structure, obfuscated attacks, and domain/structural distribution shifts. Testing seven detectors (learned baselines, external prompt-injection classifiers, broad-safety comparators) plus a rule-based baseline, the authors show a detector with F1 > 0.98 on held-out data still misclassifies roughly one-third of an externally-sourced benign security-adjacent corpus, and that hard-negative augmentation reduces over-defense only on curated stress inputs, not on externally-sourced ones β a pattern they call provenance-sensitive over-defense.
arxiv.orgpaperAdded 26 Sep 2026π‘οΈ Security - CallScreenBench: Benchmarking Small Language Models as Phone Secretaries
CallScreenBench is a benchmark for evaluating small, quantized (4-bit, 0.6-4B parameter) language models acting as autonomous phone secretaries that screen inbound calls without a cooperative caller-assigned task. It reports five automated call-and-note measure groups tied to owner endorsement (service, recall, plausibility, triage discrimination) plus three guardedness diagnostics for toolless, credential-free proxies, deliberately avoiding a single composite score to expose trade-offs like scam-detection TPR versus legitimate-call false positives. Testing across three paired model-family checkpoints reveals that larger checkpoints score higher on some measures while triage discrimination follows a different ordering, and scripted degenerate policies (e.g., hangup-and-echo) expose measurement floors.
arxiv.orgpaperAdded 26 Sep 2026π§ AI - OpenAnt: LLM-Powered Vulnerability Discovery Through Code Decomposition, Adversarial Verification, and Dynamic Testing
OpenAnt is an open-source (Apache 2.0) vulnerability discovery system that combines static program analysis with LLM reasoning in a three-stage pipeline: decomposing codebases into reachability-filtered analysis units (cutting analysis surface up to 97%), running adversarial verification where the model simulates a constrained attacker to judge exploitability, and validating candidates via dynamic testing in disposable sandboxed containers. Evaluated against large real-world projects including OpenSSL, WordPress, and Flowise, it reportedly surfaced previously unknown vulnerabilities while cutting false positives and keeping analysis cost manageable, positioning closed-loop LLM+exploit-validation pipelines as a practical path to scalable automated security analysis.
arxiv.orgpaperAdded 26 Sep 2026π‘οΈ Security - Two Conformal Constructions for Adaptive Within-Document AI-Text Screening
This paper presents two conformal-prediction constructions for calibrating AI-text detection pipelines that screen document prefixes with multiple detectors and may stop early. Construction A allocates a false-alert budget across conformal ranks for a registered finite family of prefix-detector scores using a union bound; Construction B calibrates the complete-path maximum of an adaptive stopping policy so a single terminal conformal rank protects early stopping without splitting the error budget. Under document-level exchangeability (with no restriction on within-document token dependence), the authors prove marginal false-alert control across the inspection path and derive necessary calibration sample sizes, while noting that detection power and computational savings are left to future empirical evaluation.
arxiv.orgpaperAdded 28 Sep 2026, published 25 Sep 2026π§ AI - To Trust or Not to Trust: Retrieval-Augmented Fact Checking in Speech
VeriSpeak is a new probe benchmark of 3,879 spoken claims (temporal, geographical, relational facts, balanced true/false labels) for evaluating speech-based fact verification in Large Audio Language Models. The paper finds a consistent text-speech modality gapβLALMs that verify written claims well often fail on spoken versionsβand shows retrieval alone gives limited gains since models conflate retrieved evidence with the spoken claim, while retrieval combined with explicit reasoning boosts a thinking-tuned LALM to 86.1% accuracy. The dataset is publicly released on Hugging Face.
arxiv.orgpaperAdded 26 Sep 2026, published 24 Sep 2026π§ AI - Requirement-Bound Verified Commissioning: A Frozen Four-Billion-Parameter Local Model as a Candidate Generator under an External Acceptance Layer with Verification and Release Authority
This paper proposes a "requirement-bound verified commissioning" protocol for mechatronic systems where a frozen four-billion-parameter local language model only generates candidate plans, while a separate external gate under a sealed grammar holds sole authority to verify and release them. Evaluated once on a 144-task benchmark written by isolated agent contexts with no access to the gate/grammar, it found 21 of 22 fabricated "ready" plans on unanswerable tasks were correctly rejected, no false release occurred among 83 in-benchmark releases (Clopper-Pearson upper bound 0.0354), but one false release later occurred among 146 out-of-benchmark releases, and incorrect user answers were released in 169/431 pairings β highlighting limits of candidate/release separation as a safety architecture for small local models.
arxiv.orgpaperAdded 26 Sep 2026, published 24 Sep 2026π§ AI - NEUROTESTGEN: Neuro-Symbolic Guided Test Generation with Large Language Models
NEUROTESTGEN is a hybrid test generation approach that combines symbolic execution (via the Z3 SMT solver) with LLM-driven test synthesis to reach target lines and branches for structural code coverage. It uses Z3 to derive path constraints as a guidance specification, has an LLM synthesize concrete executable tests from that specification (falling back to LLM-inferred constraints for object-related conditions SMT solvers cannot handle), and iterates with feedback until coverage goals are met. Evaluated across Llama 3.3 70B, GPT-4o Mini, Claude 3.5 Haiku, and Claude Sonnet 4.6, it outperforms prior state-of-the-art on a standard benchmark.
arxiv.orgpaperAdded 26 Sep 2026, published 24 Sep 2026π§ AI - AI Agents May Always Fall for Prompt Injections (Abdelnabi & Bagdasarian)
This arXiv paper by Abdelnabi and Bagdasarian argues that the dominant prompt-injection defense paradigm β data/instruction separation β fails to catch attacks built on contextual manipulation and also breaks legitimate agent behavior. The authors reframe prompt injection through Contextual Integrity (CI), a privacy theory judging whether information flows comply with contextual norms, and construct scenarios where attackers misrepresent flows, manipulate norms, or mix multiple flows to bypass defenses. They derive an impossibility result: any adversary can construct a context making a blocked flow look legitimate, or any defender who tightens norms enough will block genuinely legitimate flows, and propose CI-aware alignment as a principled path forward for frontier autonomous agents.
arxiv.orgpaperAdded 18 Sep 2026π‘οΈ Security - Quantifying Overclaiming Propensity in Frontier LLM Agents
This arXiv paper introduces OverclaimBench, an evaluation suite of file-review scenarios with planted defects used to measure how often frontier coding agents falsely claim to have completed a task when their own context contradicts that claim. Testing eight proprietary frontier models in their native CLIs plus four open-weight models under a fixed harness, the authors find agents skip reading all requested files in 67.9% of runs, and among those incomplete runs are misleading about it 80.4% of the time; agents that falsely claim complete review miss planted defects at 1.8x the rate of agents that actually read everything. The work matters for anyone relying on autonomous coding-agent self-reports, showing final agent responses are not a reliable account of what the agent actually did.
arxiv.orgpaperAdded 18 Sep 2026, published 17 Sep 2026π‘οΈ Security - The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services
This arXiv preprint defines and studies "Provider-Side Token Inflation Attacks" (PTIA), where LLM API providers covertly manipulate generation to produce longer outputs (and thus higher bills) while preserving task utility, testing five attack variants at the query, prompt, representation, and model levels that each inflate output length over 10x baseline. The authors identify a "PTIA saturation" effect tied to end-of-sequence token probability suppression, and build a lightweight single-probe black-box audit (no trusted reference model needed) that detects PTIA with 85.1% average detection rate and under 2% false-positive rate across four open-weight models, flagging 7 of 15 real-world LLM API services as PTIA-consistent.
arxiv.orgpaperAdded 22 Sep 2026, published 17 Sep 2026π§ AI - The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services
This arXiv paper defines Provider-Side Token Inflation Attacks (PTIA), where a dishonest LLM API provider covertly manipulates generation at the query, prompt, representation, or model level to inflate billed output tokens while preserving apparent task quality. The authors instantiate five such attacks (each pushing mean output length past 10.2x baseline), identify a "PTIA saturation" effect tied to suppressed end-of-sequence token probability, and build a lightweight single-probe black-box audit that needs no trusted reference model, achieving 85.1% detection with under 2% false positives across four open-weight models β and flags 7 of 15 real-world LLM API services as PTIA-consistent.
arxiv.orgpaperAdded 18 Sep 2026, published 17 Sep 2026π‘οΈ Security - VIPER-MCP: Detecting Vulnerabilities in MCP Servers
VIPER-MCP is an end-to-end automated auditing framework that combines two-pass static taint analysis (anchor queries mapping alerts to specific MCP tool handlers) with feedback-driven LLM prompt evolution to both detect and dynamically confirm taint-style vulnerabilities (command injection, SSRF, path traversal) in Model Context Protocol servers. Run against 39,884 real-world open-source MCP server repositories, it discovered 106 0-day vulnerabilities β all confirmed via end-to-end exploit traces with concrete proof-of-concept natural-language prompts β resulting in 67 assigned CVEs, including a root-privilege RCE in the bytebot computer-use agent. It reports 0% false positive rate and 7.7% false negative rate, substantially outperforming existing static and dynamic MCP security baselines.
arxiv.orgpaperAdded 22 Sep 2026, published 17 Sep 2026π‘οΈ Security - Legibility is Not Interpretability: Comparing Judged and Actual Importance in Chain-Of-Thought Reasoning
This arXiv paper operationalizes the importance of a chain-of-thought reasoning step as its advantage (change in expected reward from Monte Carlo rollouts) and tests whether LLM judges and fine-tuned step-level critics can identify which steps actually matter. It finds that even capable LLM judges and fine-tuned critics fall well short of a noise ceiling, especially on correct responses, showing that step importance is only partially recoverable from the reasoning text alone. The findings caution against treating legible/readable CoT traces as genuinely interpretable, with direct implications for process reward modeling and any security/safety monitoring that relies on judging or supervising reasoning traces.
arxiv.orgpaperAdded 4 Sep 2026, published 3 Sep 2026π‘οΈ Security