This paper reframes backdoor stealthiness in deep neural networks as a multi-space measurement problem rather than a single latent property. The authors benchmark ten attacks across four datasets and three architectures, measuring observable footprints in input, feature, and parameter space to show that stealthiness is fragmented: an attack can be quiet in one space and conspicuous in another. They also introduce two diagnostic metrics—CDBI and TUP—to address blind spots in global feature clustering and channel-level concentration. The central message is that future stealthiness claims should be backed by evidence from all three spaces, not by a single metric or defense.

CPS security analysts operate under need-to-know constraints that give them incomplete cross-domain views, risking flawed risk assessments. AWARE-RG addresses this by building a role-bounded abstraction lattice over Resiliency Graphs using MITRE ATT&CK tactics ordered by the ICS Cyber Kill Chain. It uses AI planning to validate attack-fault queries, repair incomplete analyst paths, and generate need-to-know explanations without exposing unauthorized predicates.

Can response safety be scored by cosine similarity to a safe-response embedding centroid? The paper shows that such a raw positive prototype identifies a location, not a separating direction, and formalizes why positive-only observations cannot determine the sign of the safe-unsafe gap. On three prompt-controlled safety corpora and four frozen encoders, the unreferenced prototype is weak or inverted while an explicit safe-minus-unsafe reference recovers useful ranking; the result is carefully scoped to the centroid rule, not all one-class methods.

Quantum key distribution deployments provision security margins assuming stationary channels, yet physical devices drift between calibrations. This paper frames adaptive eavesdropping under trusted channel noise and device drift as a constrained Markov decision process, where an attacker selects compact learnt quantum circuits each round while the noise follows an Ornstein–Uhlenbeck process. By bounding the adaptive value between the best fixed circuit and a dynamic-programming upper bound, the authors let operators measure how conservative their margins are and tune recalibration intervals, addressing a key economic barrier to QKD adoption.

This paper targets few-shot ransomware detection by pairing an Autoencoder Feature Extractor (AFE) with a Model-Agnostic Meta-Learning (MAML) classifier. The idea is to compress 72 tabular behavioral features into a 64-dimensional latent space via the autoencoder, then let MAML adapt a binary classifier from just a handful of labeled malware-versus-benign samples. The authors pitch this as a rapid-deployment defense for healthcare and critical infrastructure settings where new ransomware variants appear with little warning.

This paper addresses multi-class ransomware family classification by repurposing the Structured State Space Sequence (S4) model—designed for natural sequences—on static PE metadata. The authors reshape 71 tabular features into pseudo-sequences of length 32 and jointly train for binary detection and family classification, claiming S4 captures long-range dependencies in malware execution flow. They benchmark against CNN, LSTM, GRU, Transformer, and MLP baselines on the Ransomware Dataset 2024, reporting strong aggregate F1-scores. However, the study is limited to a single public dataset and single-run metrics, so its broader validity for IoT security remains unproven.

LLMLeak demonstrates a covert channel where malware on a network-restricted device embeds secrets into URLs within fake error messages. When users paste these traces into LLM coding assistants, the model's legitimate web-fetching tool exfiltrates the secret via DNS or HTTP requests to attacker-controlled servers. The work challenges the assumption that local LLM deployment or prompt-injection defenses alone prevent data leakage to third parties.

Quantized LLMs are increasingly deployed on edge devices for efficiency, but aggressive quantization collapses safety alignment and leaves small models highly vulnerable to jailbreaks. MOMAT proposes a hardware-aware defense that splits safety knowledge into semantic atlases and performs fast similarity search via a Compute-in-Memory (CiM) engine, paired with a lightweight Mixture-of-Experts detector. By co-designing structured retrieval with low-power acceleration, the work argues that strong guardrails can be restored on resource-constrained hardware without sacrificing benign utility.

Jev-IDS explores whether a System One Model (SOM)—the typed, probabilistic decision model Jev—can serve as a lightweight few-shot classifier for network intrusion detection. Instead of generating free-form text, Jev answers bounded noul and choice questions that return structured attack probabilities and traffic categories, promising lower latency and cost than autoregressive LLMs under label scarcity. This matters because operational NIDS deployments are constrained by per-flow inference overhead, monetary cost, and false-alarm rates, and conventional supervised detectors fail when labeled attack examples are scarce or entirely unseen.

This paper addresses the challenge of detecting network attacks in IoT environments while preserving data privacy and minimizing communication overhead. The authors propose a federated learning framework using lightweight autoencoders deployed directly on Raspberry Pi edge devices to detect anomalies in real-time through reconstruction error $\mathcal{E}(t)=\|x_{t}-\hat{x}_{t}\|^{2}$. A real-world testbed with ZigBee-enabled sensor nodes was constructed to evaluate the approach against redirection attacks, demonstrating that federated training can match centralized performance while significantly reducing data transmission from 4.5 MB to 378 KB.

SecureBreak introduces a response-level safety dataset designed to detect harmful LLM outputs that bypass alignment mechanisms. Unlike existing benchmarks that classify prompts, this work focuses on binary classification of generated responses (safe vs. unsafe) across 3,059 samples from multiple model families including Llama, Qwen, Gemma, and Mistral. The core value proposition is providing a 'last-line defense' layer for post-generation filtering and supervisory signals to guide security re-alignment, addressing the growing threat of jailbreak attacks.

This paper exposes a critical vulnerability in Multimodal Large Language Models (MLLMs): safety alignment fails when harmful intent is embedded in structured visual narratives. The authors introduce ComicJailbreak, a benchmark of 1,167 three-panel comics where panels 1–2 establish narrative context and panel 3 contains a blank speech bubble filled with a paraphrased harmful goal. The model is prompted to "complete the comic" by generating the fourth panel. Across 15 state-of-the-art MLLMs, comic-based attacks achieve ensemble success rates exceeding 90% on Gemini-family models and 85%+ on most open-source models—substantially outperforming plain-text and random-image baselines. The work also reveals that existing defenses (AdaShield, Attack as Defense) trigger severe over-refusal on benign prompts, and that automated safety judges are unreliable on sensitive-but-benign content.

Evaluating LLM outputs at scale remains a bottleneck for deploying safe AI systems. This paper conducts a comprehensive empirical study of 37 conversational LLMs serving as automated judges across eight security and quality assessment tasks. The work identifies viable open-source alternatives to GPT-4o for judgment tasks while demonstrating that popular techniques like second-level judging and specialized evaluator models underperform compared to well-prompted general models.

Retrieval-Augmented Generation (RAG) systems mitigate large language model hallucinations by integrating external knowledge bases, yet this multi-module architecture introduces complex security vulnerabilities spanning data poisoning, membership inference, and adversarial manipulation. This survey systematically maps threats across the RAG pipeline—vector database construction, retrieval, and generation—and categorizes corresponding defenses from input-side access control to output-side privacy preservation. As a comprehensive review of 152 papers, it aims to unify the analysis of threat models, defense mechanisms, and evaluation benchmarks to foster trustworthy RAG deployments in sensitive domains.

This paper introduces "silent commitment failure" — a phenomenon where instruction-tuned language models produce confident, incorrect outputs with no detectable pre-commitment warning signal — and proposes "governability" as a measurable property for AI agent safety. The core claim is that 2 of 3 instruction-following models evaluated exhibit zero-warning failure modes, with profound implications for autonomous agent deployment. The work distinguishes itself from hallucination studies by focusing on detectability before commitment rather than correctness of output, and presents empirical evidence that conflict-detection signals (the "authority band") are geometric properties fixed at pretraining rather than injectable through fine-tuning.

Existing adversarial-example-based fingerprinting schemes rely on empirical heuristics to set the fingerprint-to-boundary distance, risking violations of either robustness or uniqueness. This paper proposes AnaFP, an analytical approach that derives theoretical lower and upper bounds $\tau_{\text{lower}} < \tau < \tau_{\text{upper}}$ on a stretch factor controlling this distance. By formalizing robustness and uniqueness constraints and employing surrogate model pools with quantile-based relaxation, AnaFP generates fingerprints with guaranteed properties, validated across CNNs, MLPs, and GNNs.

DeepXplain tackles the opacity of autonomous APT defense by integrating explainability signals directly into reinforcement learning rather than treating explanation as a post-hoc add-on. The framework augments provenance-graph-based DRL with an alignment loss that ties policy decisions to GNN-derived structural explanations and temporal attributions, coupled with a confidence-aware reward shaping term. The core claim is that this tight coupling improves both task performance (F1-score from 0.887 to 0.915) and explanation quality (confidence 0.86, fidelity 0.79) compared to black-box alternatives.

Host-acting agents let users state goals while the system figures out how to achieve them. This paper argues this convenience creates a novel attack surface: semantic under-specification. When users specify outcomes but not safety boundaries, agents must fill in missing semantics—and may choose security-divergent plans even when no attacker is present and the goal is benign.

This paper investigates the security of multi-agent LLM discussions under continuous monitoring, where anomaly detectors block suspicious inter-agent messages. The authors identify that existing attacks either exhibit detectable patterns (>93% detection rates) or become ineffective when adapted for stealth (<8% success). To address this, they develop a novel attack strategy using an adversarial-aware Friedkin-Johnsen opinion dynamics model to strategically select which agents to hijack and which targets to influence. Their findings demonstrate that even under continuous monitoring, attacks can achieve over 40% success rates, revealing that monitoring alone is insufficient to secure multi-agent systems.