96 results for “Exa”

RetroChessBench is a 12-task benchmark for retrograde chess: reconstructing legal game histories, exact-length constructions, unique endings and exhaustive answer sets, with references, rubrics and a terminal-reward RL environment. GPT 6 Astra High fails to give the required final answer in 22 of 24 attempts without tools and 18 of 24 with code execution. Mean terminal RL rewards are 14.75% and 27.19%. The authors link the failures to scarce worked derivations in web training data.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

Beyond the Event Horizon of Keccak extends a 2011 observation that a path in the Keccak sponge from a zero-capacity state back to one yields infinite second-preimage families. Three theorems cover loops from any capacity value x, k-block loops and cycles, and Joux-style multicollisions with search cost independent of k. Verified examples run on Keccak-f[200] and Keccak-f[1600] with c=32; it also proposes bridge-based protocols.

eprint.iacr.orgpaperPublished and added 28 Oct 2026🛡️ Security

This paper replicates Chen et al.'s study of LLM-based smart contract vulnerability detection, first on GPT-4 and then on Mixture-of-Experts, RNN-like and State Space Models. The exact replication confirms the high-recall, low-precision pattern on GPT-4. The differentiated replication finds the pattern does not transfer uniformly: GPT-4 and Gemma-3 behave alike despite a roughly 100x parameter gap, while two MoE models diverge.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

This paper measures how much a model's final answer depends on its own written chain of thought, using a synthetic box-swap task with exact ground truth. It edits one step in the model's chain to a wrong but valid state and checks whether the answer follows. Across 25 open-weight models, reliance rises with size and saturates (Qwen3 from 16-18% at 0.6B to 97-100% at 14B). Reliance tracks capability (r = 0.99) and is unchanged by post-training.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

Soft Multi-Token Prediction (Soft-MTP) is a one-line change to multi-token prediction (MTP) pre-training. The authors show the MTP cross-entropy gradient splits exactly into a KL self-distillation term and a noisy residual, and a straight-through "KL gradient-recovery trick" keeps only the KL term. From 167M to 1.2B parameters it gives lower NTP perplexity, faster speculative decoding and higher zero-shot accuracy than standard MTP, with no added parameters or overhead.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

Radical isogenies on every model is an IACR ePrint paper by Thomas Decru (October 2026). It gives radical isogeny steps of every odd degree N directly on short Weierstrass, Montgomery, twisted Edwards, Huff, Jacobi quartic, twisted Hessian, Legendre and Jacobi intersection curves, plus Kummer lines. In Tate normal form a step drops from 12.5N to 10N multiplications. Montgomery and twisted Edwards curves cost 10.5N+O(1) per step and 2N to push a point. All algorithms are inversion-free, with exact operation counts.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

p-DCIM is a 28 nm SRAM digital compute-in-memory macro (0.16 mm2, 0.41 mW) that works as an Ising machine for RAG evidence selection. Selection is cast as a QUBO problem, and the same MAC datapath computes embedding similarities and annealing steps. Replacing LLM reranking with it gives a selection-energy estimate over six orders of magnitude lower and cuts total energy per query by 67%, with comparable token-level F1 on the evaluated examples.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Continual Learning Exam (CLE) is a benchmark of 120 human-authored tasks, each a five-level ladder (600 levels) across 89 professional roles and 12 occupational domains, built by 50+ domain experts. Agents must pass a level to unlock the next, and an evaluation agent scores submissions against human rubrics. Across 17 harness-model configurations, feedback plus one revision adds a median 5.3 points; the best system clears 47.7% of levels and finishes all five levels in 23.3% of tasks.

arxiv.orgpaperAdded 27 Oct 2026, published 25 Oct 2026🧠 AI

Persistent Closed-Form Routing (PCR) is a plug-and-play method for multivariate time-series forecasting. It alternates exact conditional estimation of channel-specific mixture weights with gradient training of low-rank residual experts around a frozen pretrained forecaster. Across eleven datasets and three backbones, PCR-K4 cuts dataset-balanced MSE by 3.86-14.25% and beats competing specialization methods with fewer trainable parameters. The paper also introduces GalaxyTS, a synthetic dataset with exact shared and channel-specific references.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

The Exact Bit Security of Hash-Based Signatures is a 2026 IACR ePrint paper that analyses XMSS with 128-bit digests and SLH-DSA-128s in the random oracle model, with proofs formalised in Lean4. Strong unforgeability comes to 127 bits under most accounting modes but only 122 bits if just direct random oracle queries are counted. The authors give matching attacks, and show how resource accounting changes the result.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

SCI-AGENT-EXAM is a workflow-oriented benchmark of 120 expert-curated tasks across 11 scientific fields and 7 task types from the Scientific Workflow Task Taxonomy (SWTT). Tasks need both executable and textual artifacts, scored by programmatic checks plus an expert-calibrated LLM judge. Ten frontier agents were tested: GPT-6 Astra scored highest at 80.9, but only 26.0% of its runs passed the 0.95 success threshold.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

MPQ (Message-Passing Quantization) is a post-training quantization method that treats row-wise PTQ as posterior inference over discrete codebooks. It keeps soft posteriors across weight blocks using vector approximate message passing, then refines a hard-decision initialization with exact block coordinate descent. Tested at 2-bit lattice and 3- and 4-bit scalar quantization on Llama, Qwen and Mistral models, it improves perplexity and zero-shot accuracy over GPTQ-style baselines.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

Rate-Controlled Refresh (RCR) is a KV cache re-selection method for multimodal LLMs in long-form generation. Attention drift decides when and where to re-select visual tokens, and a per-sample controller sets how often. RCR beats InfiniGen by 1.6-3.8 ROUGE-L points on five of six model-task settings and stays within 1.7 points of exact per-step re-selection. On video description, where drift is homogeneous, it no longer beats a fixed threshold.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

IFC-MCQ is a method that automatically generates multiple-choice benchmarks from Industry Foundation Classes (IFC) building-model files, so answers can be graded by exact option-set match instead of human or LLM review. Its taxonomy has 15 categories and 36 subtypes in four groups, with answer keys from the file and distractors from file values or rules. Two agentic setups, tool-based and code-based retrieval, showed category-specific failures and variation by IFC model and interface.

arxiv.orgpaperAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

Paper on prompt injection delivered through forensic evidence, where the seized device's contents are attacker-controlled and the examiner must read them. It extends the anti-forensic model to cover manipulation of the reasoning layer and gives a taxonomy (objective, technique, payload location, concealment). Three proof-of-concept attacks on an LLM-assisted analysis pipeline change a reported conclusion, write attacker-chosen content to the analyst workstation, and trigger outbound network traffic. Mitigations are proposed.

arxiv.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

This ePrint paper gives the first exact bit-level models of modular multiplication z=(x·y) mod 2^n. One model is for monomial prediction under 3SDP-woU, the other for impossible differential search. Applied to the MSX lightweight cipher, it yields a 7-round integral distinguisher (2^96 data) for MSX-128, key recoveries on 8 and 9 of 18 rounds at about 2^228 operations, and 1,984 seven-round impossible differentials. Both models are implemented in CLAASP.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

A Spectral Theory of Local-to-Global Leakage is an IACR ePrint paper (2026/2571) by Rei Ueno on additive secret sharing over finite abelian groups. It gives an exact leakage decomposition into local leakage magnitude and spectral alignment across shares. Two channels with identical local mutual information can have exponentially different global leakage. Automorphism-weighted sharing can cancel leakage perfectly with finitely many shares, which ordinary additive sharing cannot do.

eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Fault-Induced Nonce Repetition in Threshold Lattice Signatures is an ePrint paper (2026/2566, Yulong Meng) showing that faulting t devices in a t-of-n threshold ML-DSA deployment recovers the full signing secret, verified on Mithril with exact recovery in 96/96 scan groups. It gives a reveal-structure criterion across Quorus, TALUS and Trilithium, a threshold law m* = (ℓ-1)N+⌈N/K⌉ for imperfect faults, and two-layer transcript detection (305/305 hits, no false positives).

eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

CHARRM is a verification methodology for masked hardware circuits in the (g, t, c)-robust (p, ε)-random probing model. It extends leakage characteristics to glitch-extended and transition-extended robust probing on arbitrary circuit structures, and links them to the Set of Input Shares (SIS) function for composability notions. It outperforms IronMask on larger circuits and gives exact verification of larger composed circuits in case studies.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Evasive Inner Product Functional Encryption Is Broken Too is a 2026 ePrint paper by Agrawal, Modi, Yadav and Yamada. It gives a counterexample showing the evasive IPFE assumption of Hsieh, Lin and Luo (Eurocrypt 2024) is false in full generality. The attack extends the 2025 PRFE counterexample and needs only the weak inner product functionality, not pseudorandom function computation. The authors conclude that letting the adversary choose unrestricted private coins breaks the Evasive LWE family.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

A Note on the Security of ECDSA with Presignatures or Biased Nonces (Couteau and Makriyannis, ePrint 2026/2545) examines alternative ECDSA modes built for faster distributed signing. It shows that the security of some variants used in deployed libraries is equivalent, in the generic group and random oracle model, to the average-case hardness of k-SUM. It also proves fine-grained lower bounds on generic group attacks against modes analyzed by Groth and Shoup (Eurocrypt 2022).

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

The paper presents a fault attack on deterministic CSIDH and OSIDH-LD. Forcing the lane-selection mask to zero (for example by skipping one instruction) makes output changes reveal whether a secret exponent reaches a threshold. Binary search then recovers the full key in at most 297 queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. Full OSIDH-LD keys were recovered in software fault simulation, and a ChipWhisperer-Lite skipped the target instruction with probability at least 0.94. The authors argue fault resistance requires giving up determinism and propose randomization countermeasures.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

ePrint 2026/2527 by Paola de Perthuis and Filip Trenkić analyses module-BKZ attacks on NTRU+, the South Korean KEM standard. It introduces relative canonical and coefficient embeddings and shows they agree up to scaling exactly when rad(c)/rad(ℓ) is 1 or 2. Simulation-based estimates show the best module attack saves 4 to 10 blocksizes, costing NTRU+ keys at most three bits of Core-SVP security. NTRU+ parameters stay safe in the overstretched regime.

eprint.iacr.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

"GKS FHE: Security Analysis" is a Cryptology ePrint Archive preprint (2026/2523, October 2026) giving a formal security analysis of the Gribov-Kahrobaei-Shpilrain private-key fully homomorphic encryption scheme. The abstract says the scheme needs no bootstrapping or de-linearization, gives bit-exact decryption, supports native encrypted search and has unbounded depth. The page shows only the abstract, so the analysis's methods and results are not visible.

eprint.iacr.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

Determines, to first order in 1/p with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over F_p-bar (p ≡ 3 mod 4) that are optimally (N,N)-split. The expected number of optimal splittings is exactly 5N·J_2(N)(p-1)/(p²+1), so the split proportion is about 5N·J_2(N)/p. This gives the stationary target density of the splitting-detection attack on the dimension-two superspecial isogeny problem, which was previously known only from experiments or a one-sided bound. The proofs use Siegel's mass formula and genus averages over refined Humbert invariants, and every formula was checked by exact computation at twelve primes.

eprint.iacr.orgpaperPublished and added 17 Oct 2026🛡️ Security

Zippel is a language, compiler, runtime and analyzer for writing zero-knowledge proof systems in syntax close to the pseudocode in cryptography papers. Its type system and runtime remove vulnerability classes by construction, for example by synchronizing transcripts automatically and applying the Fiat–Shamir transform correctly. Its static analyses check completeness and soundness from the protocol description alone. The authors implemented 35 proof systems, including Sumcheck, Schnorr, KZG, Groth16, Bulletproofs, Hyrax, Spartan, Dory, HyperPlonk, DeKART and Pari. They report performance competitive with hand-written multi-core implementations.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

HardEval is an execution-verified benchmark for language-model security hardening, built from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline. Models receive only the required security outcome and write a Bash script, which runs on a live VM and is graded fail to pass with OpenSCAP/OVAL checks. Fourteen frontier and open-weight configurations show uneven results across domains, with plausible code that misses the exact compliance condition. The benchmark is public.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

HardEval is an execution-verified benchmark for LLM-driven security hardening, built from Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline. Models receive only the security outcome and write a Bash script, which runs on a live VM and is graded fail-to-pass by OpenSCAP/OVAL checks. Fourteen frontier and open-weight configurations show uneven results across SSH, authentication, audit and kernel domains, with a common failure of plausible code that misses the exact compliance condition.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🛡️ Security

ePrint paper presenting safeRNSgcd, which computes the single Bézout coefficient needed at the deepest level of Falcon's NTRU solver while keeping large integers in a residue number system. Centered explicit CRT recovers the exact low bits needed by SafeGCD batches using single-word fixed-point arithmetic. A C implementation integrated into ntrugen reduces inversion and private-key basis-generation cost on a Raspberry Pi 5 and two x86-64 CPUs, versus the original ntrugen and a variant that skips the unused coefficient.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Many Biases, One Circuit is a October 2026 arXiv paper that traces attention heads behind cue-following (for example "I think the answer is B") through two post-training pipelines. Four cue types share a few heads already present in pretrained models. About 200 generic assistant examples activate them in chat format, and the final RL stage strengthens cue effects. Swapping attention patterns of six middle layers between Tulu-3-8B and OLMo-2-7B checkpoints moves cue effects most of the way.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

The paper introduces 3DVerifierBench, a 10-task benchmark for generative verification of 3D content. It scores accept/reject decisions, rejection explanations, and responses to controlled changes in specifications and candidates. A human study shows a 21.6-point gap to the strongest tested model, GPT-6 Astra. The authors also build a pipeline of multi-view fact extraction, controlled 3D editing and native annotations. It yields 14,126 training examples with contradiction explanations and linked counterfactuals. Verification-guided selection raises complete factual success from 26.7% to 90.0% with oracle selection over sixteen candidates, and human-guided recursive refinement satisfies all seven requirements for every input in an eight-input study.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

GhostFaceMPC is presented as the first end-to-end face recognition system that runs both the deep CNN feature extractor and the matching step under secure multi-party computation. Raw images and biometric embeddings are never exposed at any stage, from feature extraction through storage to matching. The authors contribute an MPC-friendly quantization of the GhostFaceNet model and circuit optimizations that make this practical, and they release code on GitHub. It is relevant as an example of making CNN inference feasible under cryptographic constraints.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🧠 AI

Paper arguing that agent human-approval prompts count as a second factor only if agent compromise cannot forge them and they name exactly what is approved. It defines twelve attacks on the approval path (decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting, threshold splitting) and tests them against AP2, Microsoft's action-bound approval design and MCP elicitation. An audit of ten agent runtimes found no third-party verifiable approval record and post-approval argument changes in four of eight. The reference defense ASU (Agent Step-Up) renders the card from a canonical effect descriptor, has a phone passkey sign its digest, and executes only the stored call. It is proven in Tamarin (53 lemmas) and evaluated on 27,108 scripted trials and 609 AgentDojo pairs. The trusted card cut forged-narration attack success from 0.54 to 0.03 and raised LLM-approver catch rate from 0.30 to 0.98.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

Evaluates a native probabilistic decision model (Jev), Llama Prompt Guard 2 (22M and 86M) and an LLM judge on 47,611 held-out examples covering direct/indirect prompt injection, hard-benign inputs, obfuscation and distribution shift. The LLM judge has the best AUROC (0.897), followed by Jev (0.871), Prompt Guard 2 86M (0.757) and 22M (0.714). Jev's native probabilities do not consistently beat post-hoc calibrated classifier scores, and temperature scaling improves calibration but not discrimination. At a 1% false-negative-rate target, every system needs over 91.8% escalation, so probabilistic outputs alone do not give reliable security decisions under distribution shift.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🛡️ Security

Paper that links linear, integral, differential-linear and restricted differential distinguishers through two-way conversions with explicit divisibility guarantees and data complexity. It gives automated MILP/SAT models (Walsh and ultrametric representations, exact mix-basis models) and a black-box FWHT histogram search for zeros and finite divisibility. It improves Beyne–Verbauwhede divisibility bounds in 674 SIMON cases (e.g. 2^5 to 2^11 on 9-round SIMON32) and PRESENT. It also gives first higher-divisibility proofs for 8-round SPECK and BEANIE, new bounds for GIFT-64 and Ascon, and new properties on RC5, ChiLow-32, KeeLoq and KATAN32.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

DPF-SGD is a federated SGD algorithm that stays robust to Byzantine agents while satisfying ϵ-differential privacy. It combines private step sizes with a DP noise-decay schedule and adds a privacy-preserving comparative elimination (PPCE) filter that suppresses Byzantine updates during aggregation. The authors prove almost-sure convergence to the global optimum despite persistent noise and adversaries. On synthetic and MNIST data, final optimization error is one to two orders of magnitude lower than DP baselines.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🧠 AI

RepProbe is a benchmark of 42K real and synthetic video clips with exactly 1–20 complete action repetitions, controlling for clip position, temporal coverage and duration. Video language models' counting accuracy collapses at high counts, and this is not explained by frame sampling alone. Linear probes on final-layer representations show count information stays linearly decodable even when the model's answer is wrong, so the failure arises at the output stage, where answers cluster on a few preferred numbers.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Game2Real-Bench tests whether vision-language model performance on procedurally generated toy games predicts real-world visual reasoning, and whether game examples help transfer. It has 1,000 verifiable game samples and 400 real-world samples, matched by shared reasoning requirements (fine-grained perception, spatial reasoning, constraint reasoning, sequential planning). Across 25 VLMs, game and real scores correlate strongly (Pearson/Spearman 0.935). One-shot game-to-real transfer on four models improves constraint reasoning for several but hurts fine-grained perception. The authors also release Game2Real-Dataset, with about 24K verified game samples across 18 tasks and 65 QA families.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Proposes a task where a model judges and diagnoses a candidate program from only the problem statement and source code, backing its verdict with generated counterexamples that can be checked by execution. The authors build USACO-JUDGE from USACO 2026 contests (human and LLM-written accepted and unaccepted programs) and train ARBITER, a 35B MoE agentic verifier, with reinforcement learning in a generic execution sandbox. Training lifts counterexample success on incorrect programs from 40.61% to 62.67% and mean binary verdict accuracy from 71.41% to 87.41%. ARBITER also improves code selection and refinement, and in an IOI 2026 case study its guided refinement lifts GPT-OSS-120B's expected score above the gold-medal threshold under the official submission limit.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Proposes Geometric Calibration of supervised fine-tuning and SPACE (Subspace Projection for Adapted Checkpoint Enhancement). SPACE is a post-hoc, data-free, training-free method that uses the pre- and post-SFT checkpoints to revert SFT update components lying in the principal subspace of the pre-SFT weights and keep those in the orthogonal complement. It is evaluated on Qwen2.5, Qwen3, Qwen3.5, Llama-3.1 and Olmo-3 models (2B–14B) with math, coding and medical SFT. It reduces out-of-domain regression and improves in-domain performance, for example +2.85 ID / +2.26 OOD on Qwen2.5-7B math SFT.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Introduces Structured Recipe Optimization (SRO), a paradigm for automated LLM post-training that optimizes over a task-adapted recipe space covering data sources, data processing, cross-domain composition and training configuration. It pairs an LLM-based Recipe-Space Designer, which builds the recipe space for the target tasks, with a Multi-Domain Recipe Optimizer that uses structured trial evidence to guide LLM candidate construction and multi-objective Bayesian trial selection. SRO gets the highest average score in all evaluated target-model and agent-LLM combinations; for example, 41.1 vs 15.4 for the strongest baseline on Qwen3-1.7B with GPT-5.4, and 53.8 vs 40.8 on Qwen3-4B with DeepSeek-V4-Flash, in joint post-training across three capability domains and six benchmarks.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Short paper analysing the HM-QCT hybrid quantum–computational time-lock QKD protocol (Mazzoncini et al., 2025). It spells out the two "harvest now, decrypt later" strategies (quantum memory and classical memory) and shows each is excluded by exactly one of the two assumptions: short-term encryption and low-fidelity quantum storage. It then proposes HM-PRF, which replaces the short-term encryption with a locally evaluated pseudorandom function, so security needs only one-way functions rather than a predicted lasting gap in quantum memory technology.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

ePrint paper showing that FIPS 204 Table 1's expected iteration counts for the ML-DSA signing loop cover only the line-23 validity checks (z and r0 norms). They omit the two line-28 encoding-correctness checks (‖c·t0‖∞ and hint weight). It accounts for all four conditions: z by exact counting, c·t0 by an Irwin-Hall tail, and hint weight by a closed-form conditioned per-coefficient probability with a Monte Carlo tail estimate. Corrected expected iterations are 4.36, 5.14 and 3.91 for ML-DSA-44, -65 and -87, within 0.14% of an end-to-end measurement and consistent with NIST's FIPS 204 errata.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

The paper analyses stateful hash-based signatures whose key is a tree of hash chains, and asks what a second signature from the same one-time key reveals after state loss or rollback. It proves that the values derivable from several signatures are exactly the union of those from each signature alone. It also bounds forgery after b signatures in the classical random-oracle model by a combinatorial coverage exponent λ_b, including when the signer grinds a counter. It then introduces CUTS, a scheme on one binary tree whose chain positions sum to a fixed value S and whose signature size and verification cost do not depend on tree height. One parameter set has 1,424-byte signatures and λ_2 ≥ 128.6. A counter variant, CUTS+C, gives a proven grinding gain.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Endor Labs' 2025 State of Dependency Management report examines how AI coding agents and MCP servers add supply chain risk. Researchers analysed 10,663 GitHub MCP server repositories and tested AI-generated dependency recommendations across PyPI, npm, Maven and NuGet, finding agents import vulnerable or non-existent packages. MCP servers are immature: 75% are built by individuals, 41% lack license info, and 82% use sensitive APIs. The report advises treating AI-generated code as untrusted third-party input subject to code review, SAST/SCA and dependency governance.

endorlabs.compaperPublished and added 12 Oct 2026🛡️ Security

The paper proves that some properties of UOV (Unbalanced Oil and Vinegar) public-key ideals and varieties hold generically. These include equidimensionality of the UOV varieties and radicality of the public key ideals. This justifies the regularity assumptions used in algebraic cryptanalysis of UOV and its variants. The authors also review earlier multivariate schemes that were broken because they were non-generic, and give one counter-example whose non-genericity looks hard to exploit.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Paper on the forensic analysis of a stand-alone HackRF One with a PortaPack running Mayhem firmware v2.0.1. It establishes at source-code level which data sit on the microSD card, their formats, when they are written and how to interpret them. The method is applied to a four-month SD image and covers RTC-battery-dependent timestamp rules, traces of on-device trimming and text editing, cluster-level recovery of deleted IQ captures, and decoding of recorded signals cross-checked with an independent decoder. In the example, the tail of a deleted IQ capture and a trimmed-away segment are recovered, and six captures are attributed to one rolling-code OOK transmitter with a shared 32-bit ID. It provides an artifact catalogue, interpretation rules and acquisition recommendations.

arxiv.orgpaperAdded 17 Oct 2026, published 11 Oct 2026🛡️ Security

KedgeFlow specifies language-independent contracts so trusted controllers can authorize state-changing operations by enterprise AI agents and privileged gateways can enforce that authority independently of agent reasoning. It combines evidence-backed policy checks, signed permission for an exact action, a single-use shared allowance, target-side conditions and retained outcome records, with two conditional properties (at most one claim per allowance; every dispatch linked to a grant and claim) that hold even if the agent is compromised. A reference implementation exposes the path via MCP; evaluation on a three-member etcd cluster gave exactly one successful claim for each of 82 allowances across 6,560 concurrent attempts, and one committed effect in a 32-call gateway race. The authors report limits: permissive policy still authorized an undesirable effect, and distributed reservations, production access routes, crash recovery and real-target exactly-once effects remain untested.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🧠 AI

KedgeFlow proposes language-independent contracts in which trusted controllers issue signed exact-action permissions and privileged gateways enforce them, using single-use allowance claims, target-side conditions and retained outcome records. It aims to stop altered approved actions, concurrent permission reuse and retries after lost responses, even with a compromised agent. A reference implementation exposes this path via MCP; evaluation on a three-member etcd cluster showed 6,560 concurrent claim attempts yielding exactly one success per each of 82 allowances. It also reports that permissive policy still authorized an undesirable effect, and lists untested areas such as distributed reservations and production access routes.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

Proposes Matched-Context Group Policy Optimization (MCGPO), which builds weighted action preferences from already-collected sibling rollouts to give credit to intermediate decisions when feedback is sparse and arrives only at the end. Comparison contexts use pre-action state summaries and rubric progress. Exact and coarse matching rules are selected by two-action support, and fixed folds separate candidate decisions from the terminal outcomes that orient them. An evidence-weighted auxiliary pairwise loss is added to GraphGPO task learning, and no critic is needed. Across six environment-backbone settings with three seeds each, it beats GraphGPO by 0.47-1.46 points on ALFWorld and WebShop with Qwen2.5-1.5B/7B, and by 3.96 and 5.16 points on WebShop with Qwen3-4B/8B. ALFWorld gains are small because baseline success is already above 92%.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

Adaptive DHiSparse extends HiSparse (host-memory KV storage that fetches only selected entries) to draft-model speculative decoding methods DSpark and DFlash2. It protects the required working set, keeps extra history while GPU memory is spare, and recovers the rest by exact fused retrieval. Queries share missing-row retrieval, draft KV uses a window-bounded ring, and verification staging is reused across layer groups. At 100K context and concurrency 128, GLM-5.3 with DFlash2 reaches 793 output tokens/s per decode GPU (1.45x HiSparse). With the same latency bounds it sustains up to 4x the concurrency. On DeepSeek-V4.1-Flash at 500K context, it delivers 1.85x the output of resident serving with DSpark.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

WOVEN is a training source and benchmark for visual transition reasoning in multimodal LLMs. It has 36,076 examples spanning 20 scene types, 5 action types and 8 reasoning types, built from rollouts of video-pretrained generative models. Evaluating 38 frontier MLLMs (including GPT-5.4 and Qwen3-VL-235B-A22B) shows systematic deficits that persist with scale. Training on WOVEN subsets of about 2,000 items improves 22 of 26 external benchmarks by up to 27.3 points, and WOVEN data can replace 30-50% of a task's own training data. The authors derive a recipe: select supervision by the reasoning operation it teaches rather than by scene or action, and prefer larger visual-state changes.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

Proposes QCOC (Query-Calibrated Operator Compression) for tabular in-context learning. It compiles the full KV cache of the in-context examples once into compact shared memory. The cache is built from clustered joint-KV prototypes that keep per-cluster multiplicities and the original example count. Prototype values are calibrated against attention query vectors with an anchored closed-form solution. On 64 held-out OpenML-CC18 datasets it has the best mean accuracy among compared compression and retrieval methods. On seven long tables it averages 0.23 points below full context. Compressing 8,192 examples to 512 slots gives 10.5x cache compression, and single-core CPU serving over 1,000 queries is up to 508x faster than dynamic retrieval and 1.98x faster than full context.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

The paper formalizes speculative decoding as a Markov reward process and derives the Expected Decoding Rounds (EDR) objective, a hyperparameter-free training loss equal to the expected number of decoding rounds, addressing cross-round coupling that prior block-local surrogate objectives ignore. It derives an exact temporal-difference gradient for unbiased stochastic optimization and an offline evaluator for comparing drafters on shared rollouts without running speculative decoding. Finetuning the DSpark and DFly drafters with EDR improves mean accepted length and beats prior training objectives across nine benchmarks in math, code, and chat.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This arXiv paper examines why current LLM-based automated vulnerability-patching benchmarks overstate model performance, identifying pitfalls at the agent level (prompting/tooling inflating success without improving patch quality), framework level (permission errors, infra bugs, timeout handling silently skewing scores), and dataset level (single PoC tests failing to verify root-cause fixes). The authors curate 112 historical bugs across 84 open-source C/C++, Go, and Rust projects, each annotated with PoC tests, regression tests, and developer-intent tests, and show that while PoC pass rates look high, developer-test pass rates stay low and barely improve with newer models. They provide guidelines for more rigorous, reproducible evaluation of LLM patching systems.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

PQ-DVSA is a verifiable secure aggregation protocol for federated learning that aims to be post-quantum secure, tolerate client dropouts, let clients verify a server's aggregation result, and resist bounded collusion between the server and clients, while also protecting the aggregation weights, not just model updates. The authors report learning performance comparable to exact weighted aggregation and up to 96 percent lower per-client encrypted-submission runtime than SWAS, the closest prior scheme.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

PQ-DVSA is a verifiable secure aggregation protocol for federated learning that combines post-quantum cryptography, resilience to client dropouts, and verifiability of the server's aggregation result under bounded server-client collusion. It protects both clients' local model updates and their aggregation weights, lets the server reconstruct the aggregate mask for the active client set after dropouts, and lets clients cryptographically check the aggregation result. Experiments show learning accuracy comparable to exact weighted aggregation while cutting per-client encrypted-submission runtime by up to 96% versus SWAS, the closest prior scheme.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

World Models' Last Exam in Physics introduces a measurement-based benchmark of 40 controlled tasks across mechanics, optics, fluids, thermal/phase-change phenomena, electromagnetism, and surface tension, designed to test whether video world models generate physically consistent outputs. Each task pairs an initial image and prompt with predefined physical criteria, and a custom evaluator combines observability screening with task-specific quantitative measurements rather than relying on reference videos or model-based judgments. Testing eight video generation models across 1,280 generated videos found persistent physical inconsistencies, with the best model scoring only 57.76/100, and the evaluator showed higher agreement with human judgments than a vision-language model baseline.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

An IACR ePrint paper by Yiming Gao, Xuyuan Han, and Honggang Hu presenting provable classical subexponential algorithms (running in roughly 2^((1/2+o(1))n/ln ln n) time/space) for recovering short secrets in growing parameter families tied to all seven NIST third-round lattice candidates: Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, Dilithium/ML-DSA, Falcon, and cyclic NTRU-HPS/HRSS. The approach extends the Wagner-style Gaussian sampling framework of Ducas, Engelberts, and Loyer (CRYPTO 2025) and a low-error decision-LWE algorithm, using an exact squared-Euclidean-norm gap to binary-search each secret coordinate, and an "affine slice search" over the public lattice for NTRU/Falcon-type quotient relations. The authors explicitly note the subexponential complexity applies to growing/weakened parameter regimes and does not reduce the concrete security of the currently specified NIST parameter sets.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security