Tool-using LLM agents extend security risks beyond generated text to actions that affect external systems. Under multi-turn decomposition attacks, a harmful objective can be distributed across individually plausible requests and tool calls, becoming apparent only from the accumulated trajectory. Existing defenses either rely on auxiliary online reasoning to recover long-horizon security evidence or assess actions after generation, often incurring additional inference cost or depending on runtime-specific action representations. We propose \emph{Reassembling Distributed Risk} (ReDiR), a generation-time defense that conditions action generation on trajectory-level security evidence. Before each action, ReDiR compresses the current trajectory into a compact latent safety representation and injects it into the frozen base model. The representation is learned through same-model, cross-view supervision, where safe behavior from an explicit task view provides supervision for recovering distributed safety evidence from the original multi-turn trajectory. This design enables ReDiR to integrate cross-turn security information directly within the generation process without relying on a separate action-level safety module. We evaluate ReDiR on two agent-safety benchmarks across three model families and eight held-out tool domains. ReDiR reduces attack success rates to below 8\%, transfers to unseen tool domains, and preserves benign fidelity with low computational overhead.
Yanbo Dai, Zhenlan Ji, Zongjie Li et al.· 0 citations
LLM API resellers have become an important access layer to modern LLM services. However, multi-level resale creates an opaque supply chain: a user's request may traverse undisclosed upstream resellers, each of which can inspect or modify prompts and responses, inducing ecosystem-level confidentiality and integrity risks. Existing studies audit individual resellers, but provide little visibility into hidden dependencies across resellers. We present CacheTracer, the first API-only measurement of such hidden dependencies. Our key insight is to exploit prefix-cache reuse as a side channel to measure dependency via cache-reach relations. CacheTracer operationalizes this insight with two primitives: Flood populates fresh cache state through one endpoint, and Prove probes whether another can reuse it while excluding probe-created hits. We then conduct a real-world measurement study with CacheTracer on 39 reseller endpoints, sending 1.1 million API requests across 636 endpoint pairs. Our measurements reveal a deep, concentrated cache-reach structure: 37.1% of measured pairs exhibit shared cache reach, the containment order spans seven layers, and one cache reach is contained within at least 31 of other nodes. We further find that the recovered structure is model-specific. We also evaluate the validity of CacheTracer through both real-world consistency checks and controlled experiments. The results show its high reliability and accuracy. These findings reveal substantial hidden dependencies among seemingly independent API resellers. Such deep and concentrated dependencies can create a large potential blast radius, where a confidentiality or integrity failure along a common upstream path may affect users across multiple downstream resellers.
Security patch detection (SPD) is crucial for maintaining software security, as unpatched vulnerabilities can lead to severe security risks. In recent years, learning-based SPD approaches have achieved promising results on source code. However, they are generally not directly applicable to closed-source and proprietary software, which constitute a substantial portion of real-world systems, because such software typically releases patches only in binary form while its source code remains inaccessible. Despite the impressive performance of code large language models (LLMs) on code intelligence and binary analysis tasks, such as decompilation and compiler optimization, their potential for detecting binary security patches remains largely unexplored, revealing a notable gap between their demonstrated low-level code understanding capabilities and this security-critical task. To narrow this gap, we construct a large-scale binary patch dataset comprising 19,448 samples with two representations, assembly code and pseudo-code, and systematically evaluate 19 code LLMs of varying scales for binary SPD under both prompting and fine-tuning settings. Our initial study demonstrates that directly prompting off-the-shelf code LLMs remains ineffective; even advanced prompting strategies cannot compensate for the lack of task-specific knowledge. In contrast, fine-tuning proves highly effective, with pseudo-code representation consistently yielding the best performance. The best fine-tuned model, LLM4Decompile-9B-v2, achieves 0.915 in accuracy, 0.897 in F1 score, and 0.058 in false positive rate on pseudo-code. On average, models fine-tuned on pseudo-code improve accuracy by 27.5% and F1 score by 46.1%, while reducing the false positive rate by 46.2%, relative to their assembly-based counterparts. To understand this advantage, we analyze pseudo-code and assembly code from the perspectives of embedding-space similarity and code naturalness, and find that pseudo-code more closely resembles source code, making it better aligned with the source-code-centric pretraining of code LLMs. Motivated by this finding, we further augment the pseudo-code dataset with source code data, yielding additional gains after fine-tuning, particularly for smaller models. Beyond in-distribution evaluation, we further assess representative fine-tuned code LLMs under deployment-relevant distribution shifts and find that their robustness varies across shift types. Model performance remains stable under decompiler shift and is relatively preserved under architecture shift, suggesting that fine-tuned code LLMs retain meaningful robustness under practical distribution shifts in binary security patch detection.
Qingyuan Li, Binchang Li, Cuiyun Gao et al.· ACM Transactions on Software...· 3 citations· ⚡1