68 results for “Box”

This paper measures how much a model's final answer depends on its own written chain of thought, using a synthetic box-swap task with exact ground truth. It edits one step in the model's chain to a wrong but valid state and checks whether the answer follows. Across 25 open-weight models, reliance rises with size and saturates (Qwen3 from 16-18% at 0.6B to 97-100% at 14B). Reliance tracks capability (r = 0.99) and is unchanged by post-training.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

Heads of Security (HoS) is a prompt injection defense that enforces instruction-data separation with learned per-head attention gates, redistributing attention between trusted and untrusted tokens. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B against SecAlign++ and ASIDE. The black-box RL-Hammer attack reaches 97% ASR on GPT-OSS-20B and 85% on SecAlign but 10% on HoS. The white-box Claudini attack needs 3 times more FLOPs on HoS. HoS keeps base-model utility in few-shot settings, where SecAlign and ASIDE degrade.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Heads of Security (HoS) is a prompt injection defense that trains a small set of per-head attention gates to shift attention between trusted and untrusted tokens, separating instructions from data. Tested on Llama-3.3-70B-Instruct and GPT-OSS-20B, the black-box RL-Hammer attack reaches 10% ASR on HoS versus 97% on base GPT-OSS-20B and 85% on SecAlign. HoS keeps base utility in few-shot settings, where SecAlign and ASIDE degrade.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Tessera is a training-free evidence delivery layer for web retrieval-augmented generation. It rebuilds retrieved pages' HTML into fine-grained evidence units, each completed with page title, section path and table headers, then packs the relevant units into the reader context at the same token budget. Tracing evidence over full English Wikipedia shows chunking loses table and infobox content. Tessera adds 5 to 6 accuracy points on three QA benchmarks and carries over to agentic search.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Addendum to the GPT-6 Astra system card for OpenAI's GPT-6.1 Terra, rated Critical in cybersecurity and High in biological and chemical capability under the Preparedness Framework. It reports multiturn jailbreak and prompt-injection results, alignment tests (auto-review circumvention, ExploitGym honeypot, monitor evasion), and cyber scores: 97.10% ExploitBench, 24.5% on the internal recent-vulnerability port, 5 of 22 Sandbox Bench targets.

deploymentsafety.openai.compaperPublished and added 26 Oct 2026🛡️ Security

FNO-MoE is a Fourier neural operator with a mixture of experts that predicts the full near-explicit chemical state (Master Chemical Mechanism, thousands of species) over 30 minutes in one call. Expert disagreement selects the most informative box-model simulations, so active sampling beats random or evenly spread sampling at equal cost. Fine-tuning on longer trajectories keeps multi-hour runs stable, and the emulator runs orders of magnitude faster than the numerical solver.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

Pairwise Independence of Ten-Round AES (Zhongfeng Niu, Kai Hu, ePrint 2026/2608) proves that ten rounds of AES with independent uniform round keys and input/output whitening are within 3017/2^141 (below 2^-129) statistical distance of pairwise independent. The proof bounds the averaged difference-distribution matrix over five superbox layers, using Gram moments and MDS code constraints. Final-round MixColumns omission is retained.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 23 Oct 2026🛡️ Security

Efficient Laconic Oblivious Transfer with Malicious Security is an ePrint paper (2026/2593, ASIACRYPT 2026 revision) giving the first maliciously secure laconic OT that uses its primitives only as black boxes. It adds equivocal vector commitments and maliciously secure witness encryption to the commitment-plus-witness-encryption paradigm. Security is proven in the UC model against malicious senders and in the context model against malicious receivers. Instantiations use LWE and bilinear Diffie-Hellman assumptions in the standard model.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

RingTrace is a monitoring framework that detects Flush+Reload cache side-channel attacks by combining per-core cache-miss counters with slice activity across uncore CBoxes. Its Joint Spatio-Temporal Attribution (JSTA) builds a joint-activity matrix without model training: the largest entry is the screening score and row sums point to a candidate core. The authors report detection before secret leakage, fewer false alarms under heavy memory load, and negligible runtime overhead on commodity processors.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

SoK on design-level backdoors in block ciphers. It places four published designs (Rijmen and Preneel, Paterson, Bannier and Filiol, Peyrin and Wang) in one taxonomy and gives a sound algorithm that recovers a partition trapdoor from S-box tables. It attacks KG-DES, BEA-1 and LowMC-M: KG-DES key recovery takes minutes, and the LowMC-M MALICIOUS backdoor yields the key from 35 to 409 queries. Trapdoors hidden in linear layers leave no trace, so the authors recommend deriving constants verifiably from a public seed.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

KNOX is a regulatory sandbox for generative models that runs AI workloads inside trusted execution environments (TEEs). For agentic workloads, it derives an attested policy manifest from the user prompt (applicable regulations, expected tool calls, permitted system calls). An attested reference monitor checks each action against it, and an attested execution graph records every action and verdict. Overhead is under 1%.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

KNOX is a regulatory sandbox for generative models built by running AI agent workloads inside TEEs. It derives an attested policy manifest (applicable regulations, expected tool calls, permitted system calls) from the user prompt, and an attested reference monitor allows an action only if it matches. Actions and verdicts go into an attested execution graph that regulators can verify. The paper reports detection of prompt-injection deviations and under 1% overhead.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🛡️ Security

Mise-en-Video (MeV) is a multi-shot video generation framework where creators stage shots in 3D space and then generate the matching video. It combines hierarchical attention for multi-level narrative consistency with 3D-aware layout guidance for per-shot spatial control. The authors built a 160K-video dataset with hierarchical multi-shot texts and oriented 3D bounding boxes, and report gains over baselines in quality, consistency and subject controllability.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

IISFA (Ineffective Instruction-Skip Fault Attack) targets bitsliced block cipher implementations protected by redundancy countermeasures. Skipping one bitslice instruction leaves the result unchanged only when all m S-box inputs fall in an ineffective set, so each released ciphertext restricts all m subkeys. The authors give known- and chosen-plaintext key-recovery procedures and expected injection counts, and recover keys in every trial on GIFT, SKINNY and PIPO implementations on an 8-bit AVR microcontroller using clock glitches.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

R^2ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack that plants poisoned reasoning traces through a chat interface, exploiting LLM systems that reuse KV caches of reasoning. A preceding trace steers the model, and the retained trace keeps residual adversarial influence in its cache after the preceding trace is discarded. On three open-weight LLMs and three datasets it reaches up to 79% ASR, beats the white-box HijackKV in 8 of 9 settings, and reaches 46% ASR in a reasoning-trace retrieval system. Only 1% of retained responses are flagged by a popular prompt injection detector.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🛡️ Security

Studies "filesystem capability laundering" in MCP servers: client approval of a tool call grants the server process broad host filesystem access, so attacker-steered arguments can reach sensitive files outside the tool's declared contract. The authors build MCP-FSD, which infers per-tool least-privilege boundaries, plants credential fixtures outside them, and tests exploitability and sandbox containment by paired dynamic execution. Of 21,097 servers from nine registries, 16.4% of 4,806 triaged servers have filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances, and disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

Paper that links linear, integral, differential-linear and restricted differential distinguishers through two-way conversions with explicit divisibility guarantees and data complexity. It gives automated MILP/SAT models (Walsh and ultrametric representations, exact mix-basis models) and a black-box FWHT histogram search for zeros and finite divisibility. It improves Beyne–Verbauwhede divisibility bounds in 674 SIMON cases (e.g. 2^5 to 2^11 on 9-round SIMON32) and PRESENT. It also gives first higher-divisibility proofs for 8-round SPECK and BEANIE, new bounds for GIFT-64 and Ascon, and new properties on RC5, ChiLow-32, KeeLoq and KATAN32.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

Proposes a task where a model judges and diagnoses a candidate program from only the problem statement and source code, backing its verdict with generated counterexamples that can be checked by execution. The authors build USACO-JUDGE from USACO 2026 contests (human and LLM-written accepted and unaccepted programs) and train ARBITER, a 35B MoE agentic verifier, with reinforcement learning in a generic execution sandbox. Training lifts counterexample success on incorrect programs from 40.61% to 62.67% and mean binary verdict accuracy from 71.41% to 87.41%. ARBITER also improves code selection and refinement, and in an IOI 2026 case study its guided refinement lifts GPT-OSS-120B's expected score above the gold-medal threshold under the official submission limit.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Introduces leakage-resilient incompressible cryptography, a security model combining leakage resilience (partial key leakage plus full ciphertext) with incompressibility (full key but only part of the ciphertext or signature). It gives a transformation from incompressible symmetric-key encryption (SKE) to leakage-resilient incompressible SKE, a leakage-resilient incompressible PKE built from a new leakage-resilient non-committing KEM, and an incompressible SKE with ciphertext and compression rate 1/2 using invertible extractors. It also gives a leakage-resilient incompressible signature scheme in the random oracle model under DCR or LWE plus Decisional Linear. Black-box impossibility results show barriers to improving these parameters.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Anthropic's Frontier Red Team tests whether small open-weight models (≤30B) can autonomously replicate across commodity IoT devices. They ran Gemma4-26B-A4B over 15 off-brand Android TV boxes at 0.39 tok/s with pipeline parallelism. A Qwen3.5-9B-class model set up inference on 8 of 9 hardware types, and only GLM-5.2 completed end-to-end worm replication in an 8-node redroid ADB network, spreading to 8/8 nodes in 4 of 5 trials and 7/8 in the other. It also estimates spread using the Kimwolf botnet's size (~133k replicas, about 40 H100s of compute), shows notes inherited between generations improve Qwen3.5-9B's setup success (45% to 61–84%), and projects small models reaching the capability floor by end of 2026. It closes with defensive points: drive R0 below 1, and harden IoT devices.

anthropic.compaperPublished and added 12 Oct 2026🛡️ Security

ePrint paper presenting share-optimal, direct, uniform, first-order threshold implementations (TIs) with no fresh randomness. It shows every bijective 4-bit permutation of algebraic degree t admits a TI with t+1 shares, and introduces the first infinite families of cryptographically nontrivial power permutations with optimal TIs. The results disprove several earlier conjectures and give new glitch-resistant masking options for lightweight cipher S-boxes.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Hide and Seek (HnS) is a concept-level attribution method for black-box vision models. It needs no model weights and no concept-labeled datasets. Given a concept and an image set, it uses a vision-language model to retrieve concept-aligned images and localize the concept, masks the localized region, and takes attribution from the change in the black-box model's output. It agreed better with ground-truth attributions than existing methods on CelebA and COCO-Stuff, and it works on tasks existing concept attribution methods cannot handle, such as image captioning and satellite image segmentation.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

The paper scales white-box deception detection with activation probes to frontier monitoring settings. It builds the largest deception dataset to date (FIBS) and introduces a probe architecture that aggregates information across many layers and tokens. The probes reach 98.8% AUC on SHADE-Arena, beating an Opus 5.5 text-monitoring baseline, and improve as the underlying model grows. They also handle "introspective deception", where ground truth can't be read from context: they separate transcripts containing a model's true hidden goal from others with up to 99.7% AUC, and detect lying on politically sensitive topics and under pressure in open-weight models. The FIBS dataset is released.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

Introduces AgenticBBO-Bench, a benchmark for LLM-agent black-box optimization across synthetic functions, hyperparameter optimization, database tuning, chip design and molecular design under a unified finite-budget protocol. Agentic BBO beats direct LLM methods in all five domains and the best numerical optimizers in four. Ablations show extra numerical tools don't consistently help, task semantics help more than specific priors, and numerical optimizers can absorb gains from agent-found trajectories. A five-task frontier challenge evaluates seven LLMs under the Codex agent harness, with GPT-6 Astra and DeepSeek-V4.1-Flash on the performance-cost Pareto frontier.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

ePrint paper giving four constructions of optimal threshold implementations (t+1 shares, no fresh randomness) for bijective S-boxes, a masking countermeasure against differential power analysis and glitch leakage in hardware. It shows that Q30^5 admits optimal TIs, gives a matrix criterion for quadratic permutations (yielding new 6-bit classes), and gives a weighted interpolation construction for power permutations that disproves the Piccione et al. 2023 conjecture. It also gives a derivative-uniform framework that proves every 4-bit cubic permutation admits optimal TIs. A companion repo has TIs for 5-bit quadratic permutations, 4-bit cubic permutations, the PRESENT S-box and GF(16) inversion.

eprint.iacr.orgpaperAdded 11 Oct 2026, published 8 Oct 2026🛡️ Security

BRANCH is a bypass methodology for guardrail systems built from multiple scanners (prompt injection/jailbreak detectors). It uses a branching tree search that applies adversarial perturbations to individual scanners and selects techniques based on overall improvement across all scanners, decoupling bypass evaluation from attack signal optimization. It reports 100% attack success across 6 guardrail systems in 120 scenarios with 72% fewer queries and 4.5x lower wallclock time than established techniques, and transfers to 29 unseen guardrails, including 8 commercial black-box ones.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

This IACR ePrint note revisits a 2025 Crypto paper by Belohorec et al. that proved the PST multivariate polynomial commitment scheme is black-box extractable under two new assumptions, ARSDH(n) and GARSDH(n). The authors show both are in fact equivalent to the original ARSDH assumption from Lipmaa et al. (Eurocrypt 2024), and separately identify a gap in the proof that canonical PST is extractable under GARSDH(n). This matters for implementers and auditors relying on PST/KZG-style polynomial commitments, as it clarifies the actual cryptographic strength underpinning extractability claims used in zk-SNARK and other succinct-proof constructions.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

CorrectGuard is a framework for estimating whether black-box AI security guardrails made correct decisions on inputs that are inaccessible to humans (production privacy) or to the guardrail-auditing model itself, using only labeled "eyes-on" data and no internal access to the guardrail. The authors test in-context-learning, embedding, and finetuning-based correctness classifiers across 13 safety/security datasets (harmful content, jailbreaks, prompt injection, extraction) and multiple open-weight guardrails, showing up to 25-point macro-accuracy gains in error identification and improved risk-based abstention/ranking of guardrail decisions.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🛡️ Security

CorrectGuard is a framework for estimating how accurately black-box security guardrails (jailbreak, harmful-content, prompt-injection and extraction detectors) perform on inputs that cannot be inspected by humans or by the evaluating model itself, using an independent correctness model trained only on labeled "eyes-on" data. The authors test in-context-learning, embedding-based, and fine-tuned correctness classifiers under leave-one-dataset-out evaluation across 13 safety/security datasets and multiple open-weight guardrails, showing up to 25-point macro-accuracy gains and improved risk-coverage tradeoffs (AURC reduced from 0.33–0.44 to 0.17–0.22) for guardrail decision ranking and abstention. The work matters for anyone building auditing or eval pipelines for opaque safety classifiers without privileged access to their internals.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI