REPORTS
Fresh threat intelligence we ingest from public vendor and research feeds — each report linked to its original source. Search, filter by source, and open the reference.
Reports
Newest first. Search, filter by source, open the original.
825 reports · page 2 of 21
arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
Lazy Arithmetic using Systolic Arrays for Closing the Verification Gap on Embedded Systems arXiv:2607.15328v1 Announce Type: new Abstract: Complex algorithms such as deep neural networks are increasingly being deployed on embedded, resource constrained platforms. However, existing hardware and software schemes for implementing these models on the edge fall short, particularly for safety-critical applications such as medical devices. First, hardware such as GPUs, NPUs and TPU…
Read original ↗https://arxiv.org/abs/2607.15328arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs arXiv:2607.15937v1 Announce Type: new Abstract: Large Language Models (LLMs) are increasingly used for source code generation despite their outputs often exhibiting security vulnerabilities. Prior work shows that prompt engineering can mitigate such risks, yet (1) they focused on high-level prompting strategies, neglecting recent evidence that fine-grained syntactic variations can substant…
arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception arXiv:2607.15839v1 Announce Type: new Abstract: DICOM is the dominant protocol for exchanging medical images, yet many Internet-facing deployments lack basic security controls, exposing sensitive patient data to unauthorized access. Accurately measuring this exposure is complicated by honeypots, network telescopes, and other measurement artifacts that inflate published estimates. …
Read original ↗https://arxiv.org/abs/2607.15839arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure arXiv:2607.15754v1 Announce Type: new Abstract: Cyber-attacks against exposed healthcare infrastructure threaten sensitive patient data and clinical operations, yet existing defensive tools for DICOM-based medical imaging systems provide limited interaction and are easily fingerprinted. We introduce DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services using realistic interaction…
Read original ↗https://arxiv.org/abs/2607.15754arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
From Neural Intent to Cryptographic Authorization: Governing Agentic Workflows arXiv:2607.15596v1 Announce Type: new Abstract: The rapid adoption of artificial intelligence (AI)-driven and agentic workflows is transforming traditional government and enterprise systems into language-based, tool-using and increasingly autonomous infrastructures. Conventional key management services authenticate who may invoke a cryptographic primitive, but remain agnostic to which workflow ste…
Read original ↗https://arxiv.org/abs/2607.15596arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents arXiv:2607.15657v1 Announce Type: new Abstract: Multimodal AI agents increasingly rely on persistent long-term memory to ground generation in past visual and textual episodes. We show that unconditional trust in visual data creates a critical vulnerability. We propose Lucid, a black-box adversarial framework that compromises multimodal memory pipelines under a strictly ima…
Read original ↗https://arxiv.org/abs/2607.15657arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts arXiv:2607.15673v1 Announce Type: new Abstract: Smart contract vulnerabilities pose severe financial risks, yet existing security tools largely stop at vulnerability detection, offering limited support for explaining whether reported flaws are exploitable, how attacks unfold, and what concrete damage they cause. To bridge this gap, we propose KASS (Knowledge-Augmented Attack Synthesis and Simulatio…
Read original ↗https://arxiv.org/abs/2607.15673arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
On the Impact of Entropy-based Features arXiv:2607.15379v1 Announce Type: new Abstract: Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffic classification. The main idea is to use entropy to represent variability in selected traffic…
Read original ↗https://arxiv.org/abs/2607.15379arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
FLINT: Fingerprinting Federated Learning Architectures from 5G PHY-Layer Side Channels arXiv:2607.15469v1 Announce Type: new Abstract: Federated Learning (FL) over 5G cellular networks protects raw data but remains vulnerable to side-channel leakage. Prior fingerprinting attacks assume packet-level network visibility, an assumption that does not hold at the 5G Physical (PHY) layer, where user payloads are encrypted and Radio Network Temporary Identifiers (RNTIs) may change o…
Read original ↗https://arxiv.org/abs/2607.15469arxiv_cs_cr · tlp:amber · 7/20/2026, 4:00:00 AM
Publicly-Verifiable Certificates for Statistical Algorithms arXiv:2607.15528v1 Announce Type: cross Abstract: Following Goldwasser, Rothblum, Shafer, and Yehudayoff, who defined a framework for interactive proofs of learning [ITCS'21], we initiate the study of non-interactive proofs of learning. We define and study a new notion: Publicly-Verifiable Certificates of Statistical Validity (pvCSVs), which allow for public, distributionally-robust certification that the result of …
Read original ↗https://arxiv.org/abs/2607.15528arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Qubes OS Security in the Public Record arXiv:2607.14587v1 Announce Type: new Abstract: Qubes OS is a revealing case for security measurement because its architecture makes component boundaries security-relevant. We present a protocol-driven longitudinal analysis of 109 public Qubes Security Bulletins (QSBs, 2011--2025), the official Qubes-maintained Xen Security Advisory (XSA) tracker, and a secondary vulnerability-event sensitivity series. The study measures the public advi…
Read original ↗https://arxiv.org/abs/2607.14587arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems arXiv:2607.14611v1 Announce Type: new Abstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future be…
Read original ↗https://arxiv.org/abs/2607.14611arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
NFSA: Non-Forward Secure Aggregation with One Server via Two Layer Secret Sharing arXiv:2607.15052v1 Announce Type: new Abstract: Federated Learning (FL) enables collaborative model training while preserving privacy by keeping data local. However, the risk of sensitive data leakage through model updates necessitates the use of secure aggregation protocols. Existing server-based secure aggregation protocols typically require the server to forward sensitive data shared between…
Read original ↗https://arxiv.org/abs/2607.15052arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Disclosure Divergence: Measuring Privacy Policy and Data Safety Misalignment at Scale arXiv:2607.14442v1 Announce Type: new Abstract: With the rapid growth of mobile applications, user data privacy has become an increasing concern. While privacy policies describe how apps collect and share data, platforms such as Google Play provide Data Safety labels intended to summarize these practices. Because these disclosure channels are declared separately, they may present inconsiste…
Read original ↗https://arxiv.org/abs/2607.14442arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation arXiv:2607.14493v1 Announce Type: new Abstract: Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insigh…
Read original ↗https://arxiv.org/abs/2607.14493arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Fully Automated End-to-End Adversary Emulation from MITRE ATT\&CK Based Cyber Threat Intelligence Using LLMs arXiv:2607.14566v1 Announce Type: new Abstract: This paper presents a fully automated end-to-end framework for adversary emulation from MITRE ATT&CK-aligned CTI reports using LLMs. Unlike prior work, which either executes prewritten playbooks or partially automates playbook generation, our framework unifies playbook generation, execution, and failure recovery in a…
Read original ↗https://arxiv.org/abs/2607.14566arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
DataShield: Uncovering Risky Fine-Tuning Data Across LLMs Through Consensus Subspace Alignment arXiv:2607.15081v1 Announce Type: new Abstract: Fine-tuning large language models (LLMs) on domain-specific datasets has become a standard paradigm for adapting LLMs to specialized applications. However, recent work has shown that even fine-tuning on benign task-specific data can substantially weaken the safety capabilities of LLMs. While existing efforts have made progress in iden…
Read original ↗https://arxiv.org/abs/2607.15081arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
A Queueing-Stability Criterion for Causal IPD-QIM Network Flow Watermarking arXiv:2607.14954v1 Announce Type: new Abstract: On multi-hop encrypted links such as Tor and cascaded VPNs, tunneling flattens packet lengths and protocol fields, leaving inter-packet delay (IPD) as the main carrier for active flow attribution. Causality lets the embedder delay packets but never advance them, so each quantization-index-modulation (QIM) alignment injects nonnegative dwell into a delay…
Read original ↗https://arxiv.org/abs/2607.14954arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
The Distributed Open-Source Vulnerability Ecosystem arXiv:2607.14900v1 Announce Type: new Abstract: Identifying known software vulnerabilities is a central task in software supply chain security management. Although publicly available vulnerability information is based on shared standards, different vulnerability scanners often report divergent results for identical software inventories. These differences do not arise solely from individual data sources or scanner implementa…
Read original ↗https://arxiv.org/abs/2607.14900arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Value Leakage: An LLM's Answers Are Silently Shaped by Its Own Values arXiv:2607.14345v1 Announce Type: cross Abstract: People use language models for practical questions whose answers are difficult to verify. We show that models exhibit covert value leakage: the information they provide is influenced by their own values, without this influence being disclosed to the user. In one of our evaluations, the user is considering investing in an AI company and wants to know how lik…
Read original ↗https://arxiv.org/abs/2607.14345arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Exploring Delay-based PUFs for Energy-Efficient Low-Overhead Security of Wearable Devices arXiv:2607.14395v1 Announce Type: new Abstract: The Internet of Things (IoT) was introduced almost two decades ago. In the past two decades, technology has seen huge advancements. Many devices have become powerful and have less power consumption. Many IoT architectures and environments were introduced to help make life easier, especially in wearable devices. The market for these wearabl…
Read original ↗https://arxiv.org/abs/2607.14395arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queries arXiv:2607.14811v1 Announce Type: new Abstract: Retrieval-augmented generation (RAG) enhances large language models via external document retrieval, but retrieved contexts may leak sensitive information. Current privacy protection methods typically rely on a document-level static risk assumption, treating all retrieved documents as having the same p…
Read original ↗https://arxiv.org/abs/2607.14811arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
FlowGuard: From Signals to Evidence for MCP Security Detection arXiv:2607.14754v1 Announce Type: new Abstract: The Model Context Protocol (MCP) enables LLM agents to interact with external tools through metadata exchange, tool invocation, and response consumption. Existing MCP security scanners primarily reason about suspicious semantic signals rather than real execution behaviors, which can lead to unreliable risk assessment. For example, credential-like strings may simply …
Read original ↗https://arxiv.org/abs/2607.14754arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
The Prover Is the Judge: Verified Security Software from AI Coding Agents in Ada/SPARK arXiv:2607.14340v1 Announce Type: cross Abstract: AI coding agents produce code faster than humans can review it. In our approach, the prover is the judge of whether the code is correct. Under a verifier-driven loop, AI agents wrote and verified bare-metal security software in Ada/SPARK spanning classical and post-quantum cryptography, TLS 1.3, IKEv2, X.509, and a Matrix client. GNATprove …
Read original ↗https://arxiv.org/abs/2607.14340arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Better Privacy Guarantees for Larger Groups arXiv:2607.14406v1 Announce Type: new Abstract: Pujol and Desfontaines asked whether a private histogram can allow more error on larger counts and use that slack to protect members of larger groups more strongly. We study this question for fixed disjoint groups under add-or-remove-one adjacency. The privacy budget $v(n)$ depends on the affected count, is nonincreasing, and must bound both R\'enyi-divergence directions at every orde…
Read original ↗https://arxiv.org/abs/2607.14406arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak arXiv:2607.14147v1 Announce Type: cross Abstract: Aligned language models refuse harmful requests, but a one-line prefill ("Sure, here is") strips the refusal. We ask where and how it fails. The harm representation stays intact: on the prompts the attack flips to compliance, a linear probe reads harm as high as on the refused ones (0.91-0.98), while behavioral refusal drops to chance. This holds…
Read original ↗https://arxiv.org/abs/2607.14147arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Traceback Translators Against Forgetting in Continual Fake Speech Detection arXiv:2607.12569v1 Announce Type: cross Abstract: Fake speech detectors are increasingly challenged by the development of new and more accurate generative models. To cope with this problem, continual learning techniques are nowadays widely considered feasible strategies for updating models to new datasets, but they also lead to decreased performance on previously seen samples (catastrophic forgetting…
Read original ↗https://arxiv.org/abs/2607.12569arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Lattice-based extended withdrawability arXiv:2607.14690v1 Announce Type: new Abstract: We extend the extended withdrawable signatures of Liu, Susilo and Baek to lattice-based constructions built on the Fiat-Shamir with aborts paradigm. Departing from an earlier draft that transported a per-signer shift in the clear, which leaks the signer, we realise extended withdrawable signatures as a claimable ring signature: signer ambiguity is provided by a one-out-of-N signature used …
Read original ↗https://arxiv.org/abs/2607.14690arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives arXiv:2607.14166v1 Announce Type: cross Abstract: Production LLM-agent frameworks expose control primitives -- human-in-the-loop approval gates, run cancellation, and execution timeouts -- whose names and documentation imply barrier semantics: while a run is paused, cancelled, or timed out, no gated side effect executes. We show this implied contract holds on none of the six wi…
Read original ↗https://arxiv.org/abs/2607.14166arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Automated Template-free Synthesis of Instruction-Centric Leakage Contracts for Black-Box CPUs arXiv:2607.15118v1 Announce Type: new Abstract: Side-channel attacks pose a significant security threat for modern computing platforms, because they exploit subtle discrepancies in CPU behaviors to leak sensitive information. To model the information leaked by a CPU via microarchitectural side-channels, recent work proposed leakage contracts: an ISA-level security abstraction that p…
Read original ↗https://arxiv.org/abs/2607.15118arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
A Measurement Study of AI-Environment Realism Gaps in Malware-Analysis Sandboxes arXiv:2607.14434v1 Announce Type: new Abstract: Sandboxing remains a core technique for observing suspicious program behavior, yet environment-aware malware increasingly suppresses execution when analysis is suspected. Prior generations of sandbox evasion focused on virtualization artifacts, timing discrepancies, and wear-and-tear realism. In this paper, we present the first systematic measureme…
Read original ↗https://arxiv.org/abs/2607.14434arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents arXiv:2607.14651v1 Announce Type: new Abstract: Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featur…
Read original ↗https://arxiv.org/abs/2607.14651arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents arXiv:2607.15143v1 Announce Type: new Abstract: AI coding agents set up projects by reading documentation and installing the dependencies it lists, without verifying their names, sources, or known vulnerabilities. By editing only a README, requirements file, or Makefile, an attacker can redirect the agent to an untrusted registry, a known-vulnerable version, or a wrong-but-plausi…
Read original ↗https://arxiv.org/abs/2607.15143arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents arXiv:2607.15263v1 Announce Type: new Abstract: Security-agent evaluations commonly measure peak offensive capability under generous inference budgets, emphasizing vulnerability discovery, exploit development, penetration testing, and CTF completion. Such measurements are useful but incomplete: in operational security, every reasoning step, tool call, telemetry query, and enrichment request…
Read original ↗https://arxiv.org/abs/2607.15263arxiv_cs_cr · tlp:amber · 7/17/2026, 4:00:00 AM
Privacy Leakage in Federated Learning in Radiology Reports: A Comparative Evaluation of Tokenizer-Driven Privacy Risks arXiv:2607.14205v1 Announce Type: cross Abstract: Federated learning (FL) enables multi-institutional training on clinical text without sharing raw data, but gradient inversion can reconstruct sensitive information from shared model updates. The extent of this leakage for radiology reports, and the role of tokenizer design, remains unclear. We quantify gradi…
Read original ↗https://arxiv.org/abs/2607.14205arxiv_cs_cr · tlp:amber · 7/16/2026, 4:00:00 AM
GDM AI Control Roadmap arXiv:2607.13087v1 Announce Type: new Abstract: AI agents are rapidly accelerating work at frontier AI companies, helping with AI R&D, cyber-defence, and advancing scientific discoveries. As these agents become more tightly integrated into our systems, unlocking their full potential requires rethinking how we do security. We should not assume that AI agents are always perfectly aligned, but should instead build in multiple layers of defence. We pre…
Read original ↗https://arxiv.org/abs/2607.13087arxiv_cs_cr · tlp:amber · 7/16/2026, 4:00:00 AM
DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection arXiv:2607.13439v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly applied to vulnerability detection due to their strong code comprehension capabilities, but most existing approaches rely on isolated functions or context extracted by fixed program-analysis rules. These methods cannot adaptively explore repository-level dependencies to gather sufficient co…
Read original ↗https://arxiv.org/abs/2607.13439arxiv_cs_cr · tlp:amber · 7/16/2026, 4:00:00 AM
xChk: Bring Your Own Identity -- Heterogeneous Assurance with Verifier-Determined Sufficiency arXiv:2607.13369v1 Announce Type: new Abstract: We present xChk, a reference identity provider for Bring Your Own Identity (BYOI): users enroll via heterogeneous proofs (government KYC, corporate SSO, WebAuthn/FIDO2, professional networks, live verification, longitudinal activity, behavioral signals) and disclose them as portfolio claims in standard OAuth 2.0 / OpenID Connect (OIDC)…
Read original ↗https://arxiv.org/abs/2607.13369arxiv_cs_cr · tlp:amber · 7/16/2026, 4:00:00 AM
Evaluating Frontier AI Agents as Autonomous Clinical Security Auditors arXiv:2607.13411v1 Announce Type: new Abstract: Clinical AI models can expose patients to harm when adversarial vulnerabilities go undetected, yet formal security auditing requires statistical expertise, specialized tools, and significant time. We present an open evaluation task, built on METR Task Standard v0.3.0, that tests whether frontier AI agents can autonomously implement a structured clinical AI s…
Read original ↗https://arxiv.org/abs/2607.13411arxiv_cs_cr · tlp:amber · 7/16/2026, 4:00:00 AM
The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators arXiv:2607.13075v1 Announce Type: new Abstract: Context can change whether a request is harmful without changing its topic or surface form. We ask whether residual-stream probes distinguish harmful requests from surface-matched benign controls at a useful operating point. Across three 7-8B model families, an activation sensor blocks 95.5-97.7 percent of judge-classified compliant attac…
Read original ↗https://arxiv.org/abs/2607.13075