Category
1,407 papers
Some low-cost Internet of Things (IoT) sensor deployments lack device-level source authentication, leaving them vulnerable to impersonation or injected sensor readings. We present a lightweight approach to sensor impersonation detection in a small proof-of-concept study. We formulate detection as a sequence-prediction...
Security Operations Centers (SOCs) process large amounts of tickets, most of which are low-interest events not worthy of further investigation. The repetitive nature of this task and similarity of the vast amounts of tickets make it a prime candidate for generative AI-based automation. We created and deployed an agenti...
Scratchy is presented, a visual-scratchpad approach that exposes proof-theoretic dependencies for multimodal generation in large language models and suggests that explicit proof structure can make the improvement and multimodal proof-state representation as a promising direction for computer-aided cryptography.
This work presents SCRIPTIOC-BENCH, a benchmark for measuring static IOC extraction capability on real-world malicious scripts, and evaluates a broad range of proprietary and open-weight LLMs, showing that IOC recovery without execution remains challenging across model scales.
Reach audiences
Advertise in front of researchers, engineers, and readers.
HAE-GEO is introduced, a benchmark that tracks the full trajectory from exposure to recovery under progressively more persuasive Web poisoning and finds three recurring patterns: evidence recognition degrades under the corroboration trap, agentic search improves final resistance without improving evidence recognition o...
This work presents ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure, and establishes metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance.
A provenance-aware execution graph linking agent events through deterministic state, identifier, and tool provenance is introduced, and influence distance is defined as the shortest structural path from an untrusted source to a sensitive action.
KITA is presented, a review-to-authorization architecture that keeps the user's personal secret signing key and every threshold signing-key share outside all LLM processes and establishes execution-bound authorization integrity.
This work proposes a unified detection framework SAFEGuard which incorporates a hybrid fluency measurement based on cross-layer distribution distance and perplexity, and the analysis of harmful semantics through gradient matching, and demonstrates the effectiveness of SAFEGuard against evolving jailbreak attacks.
Bait-and-Recover is proposed, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer that decouples the observation path from the behavior path.
An entropy-guided machine learning framework for real-time DDoS detection in SDN environments which is lightweight and explainable and a step towards achieving a balance between the detection performance and operational transparency in next-generation SDN security.
A guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement is developed, finding that no system enforces revocation by default.
Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility—and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research.
GPT-Lab
· gpt-lab.eu
Oct 30, 2026
Critical flaws, compromised release channels and agentic AI threats landed within days of each other in mid-October 2026. Why “Black October” may say more about how well we now find weaknesses than about the attacks themselves. The post Black October? The Week AI Changed the Cybersecurity Conversation appeared first on GPT-Lab.
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
Gemini 3.8 Flash and 3.8 Flash Cyber deliver next-generation intelligence for agentic workflows and cybersecurity.
Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model to find and patch vulnerabilities.
Students from the MIT Cybersecurity Clinic help local governments and other vulnerable organizations defend against digital threats.
We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.
