Researchers have introduced GLID, a face-forgery detector that leverages local intrinsic dimension (LID) estimates from a frozen vision transformer to identify forgeries from generator families not seen during training. On a 16-axis cross-generator benchmark, GLID achieves a mean AUC of 0.805, outperforming retrained state-of-the-art baselines. The method is training-free and significantly reduces the variability in accuracy across different random seeds.
Why it matters: GLID offers a robust, data-efficient approach to face-forgery detection that generalizes to new generator families, addressing a key limitation of current detectors.
Researchers have proposed ChainMark, a watermarking method for text generated by large language models (LLMs) that does not require access to the underlying model. ChainMark uses keyed hashing to partition vocabulary and enforces Markov transitions, enabling detection with closed-form calibration of false positive rates. The approach demonstrates robustness against translation and substitution attacks and outperforms prior methods in empirical tests.
Why it matters: ChainMark provides a practical and theoretically grounded solution for marking synthetic text, addressing regulatory needs for reliable watermarking without requiring model access.
A new study compares the adversarial robustness of two phishing email detection models: TF-IDF + Logistic Regression and fine-tuned DistilBERT. Both models achieved over 98% accuracy on clean, in-distribution data, but their performance dropped sharply to around 64% when tested against adversarially modified phishing emails. Analysis showed that while the models relied on different features, they exhibited similar vulnerabilities and complementary error patterns. The findings demonstrate that high accuracy on clean data does not guarantee robustness to adversarial attacks, highlighting the need for adversarial testing in phishing detection research.
Why it matters: This research reveals that widely used phishing detection models are highly vulnerable to adversarial attacks, emphasizing the importance of evaluating models beyond clean-data accuracy.
Researchers introduce the concept of cross-agent asynchronous campaign attribution for LLM agents, presenting Asynchronous Attribution Fingerprint Vectors (A²FV) as a lightweight method to link attack sessions from the same adversarial campaign, even when agents do not share runtime state. On the new SCD-v1 benchmark, A²FV achieves a pairwise AUC of 0.82, outperforming per-session detectors and LLM judges in linking distributed attacks. The study demonstrates that structural and stylometric residue are key signals for attribution, and that the method remains effective under various evasion strategies.
Why it matters: This work establishes a new evaluation layer for LLM agent security, enabling detection of coordinated attacks that evade traditional per-session defenses.
A new preprint introduces CPInj, a collaborative prompt injection attack that targets Textual Collaborative Prompt Optimization (TCPO), a decentralized method for improving LLM prompts. The attack injects malicious instructions into local prompts, which persist through aggregation and degrade downstream task performance, while evading current defenses. The authors also propose a defense method, APAgg, which partially mitigates the attack, but CPInj remains highly effective, exposing a significant vulnerability in TCPO systems.
Why it matters: This work exposes a critical and previously unexplored vulnerability in decentralized prompt optimization for LLMs, emphasizing the urgent need for more robust defenses against collaborative prompt injection attacks.
A new framework called AMLGuard is introduced to improve anti-money laundering (AML) in decentralized finance (DeFi) by combining static rule-based analysis with retrieval-augmented large language model (LLM) reasoning. AMLGuard infers high-level transaction semantics to track illicit fund flows, including across blockchains, and was evaluated on 82 real-world laundering cases involving over $1 billion in assets. The system demonstrated high precision and recall in reconstructing illicit fund-flow topologies for both single-chain and cross-chain transactions.
Why it matters: This work represents a notable advance in applying LLMs to financial security, offering improved tools for tracking and analyzing complex illicit cryptocurrency flows.
A new verification framework called RECEIPT aims to make LLM-based agent-reported XSS findings trustworthy by enforcing environment isolation, proof-of-concept constraints, role separation, and verdict binding. In evaluations on 95 real-world web applications, RECEIPT discovered 24 previously unknown XSS vulnerabilities within a $20 per-app budget, with 12 acknowledged by maintainers, and recovered labeled CVEs in 36% of known-vulnerability targets, with no false positives reported.
Why it matters: This work addresses the critical problem of reward hacking in LLM-based security agents, providing a deterministic verification method that could make automated vulnerability discovery more reliable and trustworthy.
A new preprint introduces HALLMARK, a benchmark designed to evaluate large language model (LLM) citation verifiers using 2,526 BibTeX entries and 14 types of citation hallucinations. The study finds that the false-positive rate, rather than recall, is the primary factor limiting the practical deployment of citation verification tools, with most LLMs tending to over-flag citations, especially for papers published after their training cutoff.
Why it matters: This benchmark provides a standardized way to diagnose and improve LLM citation verifiers, addressing the risk of fabricated references in AI-generated academic writing.
A new preprint introduces CryptanalysisBench, a benchmark comprising 191 cryptanalysis tasks across six families of cryptographic primitives. Testing five frontier large language models, the study finds that these models can break 65-86% of Tier 1 (known-break) schemes and also produce novel attacks, including a key-recovery attack on SpoC AEAD and the identification of an error in KINDI's security proof. The benchmark is released to track AI progress in cryptanalysis and to stress-test cryptographic schemes.
Why it matters: This work highlights the rapidly advancing capability of LLMs to perform automated cryptanalysis, raising both opportunities and concerns for digital security.
A new framework reformulates the task of mapping automotive CVEs to the Auto-ISAC Automotive Threat Matrix (ATM) as a selective automation problem. Using hierarchical in-context learning and a calibrated meta-model, the system assigns mappings to AUTO, REVIEW, or HOLD tiers based on confidence. In evaluation, the AUTO tier achieved a precision of 0.878 in high-confidence mode, substantially outperforming a zero-shot GPT-5.2 baseline.
Why it matters: This approach advances automated vulnerability mapping in automotive cybersecurity by enabling selective automation and reducing the risk of misclassification in safety-critical contexts.
A systematic measurement study assesses the effectiveness of current web bot defenses against LLM-based browser agents and commercial captcha-solving services. The study finds that challenge-based defenses like hCaptcha and reCaptcha v2 are broadly ineffective, as they can be bypassed by both commercial solvers and LLM agents with solver modules. Non-interactive defenses such as reCaptcha v3 show stronger resistance, but this is due to checks on execution-environment authenticity rather than agent behavior. The results indicate that the true security boundary for these defenses is at the environment layer.
Why it matters: This work highlights a fundamental shift in web security, showing that as LLM agents become more capable, traditional bot defenses are increasingly ineffective and future protections must focus on environment authenticity.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint introduces Audio BERT (AuB) and SpInv, a two-stage method for recovering speaker embeddings from speech tokens produced by end-to-end speech language models. The study demonstrates that SpInv can achieve cosine similarities above 0.70 with just three seconds of speech token output from models such as Moshi and Qwen3-Omni, indicating that these tokens can leak significant speaker identity information.
Why it matters: This work highlights a substantial privacy risk in modern speech language models, showing that speech tokens can be inverted to recover speaker voiceprints and potentially compromise user anonymity.
A new preprint on arXiv introduces 'self-state attacks,' a class of threats where self-hosted AI agents can be compromised through legitimate OS system calls that alter their own memory and configuration files. The authors systematically characterize the attack space and empirically evaluate OS-level defenses, finding that while layered defenses are effective against most attack scenarios, a small subset of attacks remains undetectable at the OS level. The study concludes that current OS-level defenses are structurally limited in fully mitigating these threats.
Why it matters: This work exposes a fundamental limitation in existing OS security measures for self-hosted AI agents, indicating the need for new approaches to defend against self-state attacks.
A new preprint evaluates nine large language models (LLMs) for scam detection across diverse real-world scenarios without task-specific fine-tuning. The study finds that larger LLMs generally outperform smaller ones, but effective prompting can significantly improve the performance of smaller models. LLMs also demonstrate better generalization to previously unseen scams compared to a fine-tuned BERT classifier. The authors release a benchmark dataset and evaluation framework to support further research.
Why it matters: This work suggests that pre-trained LLMs can be effective for scam detection without additional fine-tuning, potentially lowering barriers for deploying AI-based security tools.
Researchers introduce SlotGuard, a privacy layer for LLM agent transcripts that replaces sensitive data with format-preserving synthetic values while maintaining agent performance. In controlled experiments, SlotGuard removed all annotated structurally sensitive characters and reduced credential leakage to 0% across test cases, with minimal impact on task success rates. The method addresses shortcomings of existing redaction techniques, such as missing embedded references or over-redacting benign data, by using typed slots and session graphs to preserve transcript structure and context.
Why it matters: This approach offers a practical solution for protecting private data and credentials in LLM agent transcripts without sacrificing agent effectiveness.
A new preprint introduces RRAM-DP, a hardware-algorithm co-design that utilizes the inherent stochastic write behavior of resistive-switching random-access memory (RRAM) devices to inject calibrated noise for differential privacy in edge AIoT systems. The approach achieves at most a 3.8% accuracy drop at (ε=2, δ=O(1/n))-DP on benchmarks such as CIFAR-10/100, and demonstrates up to 57x energy savings and 2.7x speedups compared to GPU baselines. This method represents a novel use of device-level randomness for privacy-preserving, efficient in-memory training.
Why it matters: This work offers a significant advance in privacy-preserving machine learning for edge devices by leveraging physical properties of emerging memory technology, potentially enabling more secure and efficient AIoT applications.
Policy & Safety→Official→arXiv Cryptography and Security
A systematic study of cross-modal unlearning in vision-language models (LLaVA-1.5, InstructBLIP, IDEFICS) finds that unlearning knowledge in one modality (text or vision) transfers asymmetrically and incompletely to the other. The research shows that typographic attacks—manipulating the visual presentation of text—can recover previously unlearned knowledge, revealing that current unlearning methods are shallow. The proposed CrossInf mitigation strategy reduces the transfer gap by more than half and lowers attack success rates to near zero, while preserving model utility.
Why it matters: This work reveals a critical vulnerability in current unlearning methods for multimodal AI, showing that knowledge can be recovered via cross-modal attacks, and introduces a practical mitigation to improve the safety and reliability of vision-language models.
Researchers introduce A-MESS, a framework that evaluates jailbreak attacks on large language models (LLMs) based on their utility for improving model safety when used as red-teaming data, rather than solely on attack success rate (ASR). Using Shapley values, the method attributes marginal utility to individual attacks and selects compact, effective subsets for safety training. Experiments show that ASR rankings are only weakly aligned with defender-centric utility, and that optimizing attack subsets directly for safety yields better results than traditional attacker-centric approaches.
Why it matters: This work reframes the evaluation of jailbreak attacks to focus on their value for enhancing LLM safety, potentially leading to more effective red-teaming and safety training strategies.
Researchers have introduced FLOB, an obfuscation framework designed to protect floating-point computations in deep neural network (DNN) binaries using Mixed Boolean-Arithmetic (MBA) transformations. FLOB lifts floating-point values into a higher-precision binary expansion space, performs computations there, and projects results back to the original precision without introducing additional rounding error. Experiments demonstrate that FLOB reduces the operator recovery rate to 4.51%, representing a 32.82 percentage-point improvement over existing obfuscation methods.
Why it matters: This work offers a practical and effective method for safeguarding proprietary DNN models against reverse engineering, specifically addressing the unique challenges of floating-point operations.
Researchers have identified a novel attack surface in agentic retrieval-augmented generation (RAG) systems, termed 'salience induction.' Unlike content poisoning or prompt injection, this attack manipulates the prominence and framing of truthful information to mislead multi-hop reasoning agents. The team introduces a defense method called Salience Normalization, which significantly reduces attack success rates from 83.3% to 15.3% in their experiments across multiple model families and agent architectures.
Why it matters: This work exposes a critical vulnerability in RAG systems, showing that even truthful content can be manipulated to mislead AI agents, and demonstrates an effective defense.