TP-CRIV targets a third-party verification setting in which the verifier has neither white-box nor API access to the claimant's model, can interact with the suspicious deployed service only through its ordinary black-box inference interface, and does not require protocol-specific cooperation from the service provider.
Toketive is introduced, a simple yet powerful reference-free attack that exploits the tokenization-based side channel to detect modified knowledge and reconstruct the corresponding pre-edit response and shows that localized modifications should not be treated as robust knowledge-control boundaries without adversarial e...
Autonomous penetration-testing harnesses use large language models (LLMs) for reconnaissance, exploitation, and reporting, but often rely on those same models to confirm findings, grade severity, and select agents. This can lead to false positives, inflated severity, and wasted compute. We examine how System One decisi...
This work pairs application-level agent telemetry with kernel-level syscall traces to present the first paired-evidence characterization of kernel-level versus application-layer signal for agent security, finding that kernel evidence is discriminative on its own and that composing it with application-layer evidence gen...
Spencer King, Zhi-Lu Zhang, Mikhail Kuznetsov et al.· 0 citations
Reach audiences
Advertise in front of researchers, engineers, and readers.
It is shown that schema-defined outputs change but do not eliminate prompt-injection risk, highlighting the need to evaluate how untrusted content influences choices within the allowed action set.
Tian-Tong Wu, Wei Yang Bryan Lim· 12 citations· ⚡1
Multi-step tool-calling LLM agents rely on host runtimes to preserve state across turns. When a runtime carries an external tool return into later model inputs, providers meter it again. An admitted malicious or compromised tool can thereby convert untrusted data into recurring victim-billed processing without victim c...
Jin-Qian Zhang, Hao-Jun Xia, Shu-Jiang Wu et al.· 0 citations
This work presents an end-to-end diagnostic study of an Autonomous Adversary system with orchestrator, executor, and validator LLMs in enterprise-like lateral-movement scenarios and uses comparative LLM-as-a-Judge analysis to identify planning deficiencies.
Saeedeh Lohrasbi, Mohammad Mamun, Ahmed Yehia et al.· 0 citations
This work presents LIDAR (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-agent execution that achieves high Top-1 accuracy and MRR and outperforms four existing fingerprinting and API-auditing baselines.
Chu-Yi Wang, Xiao-Hui Xie, Tong-Ze Wang et al.· 2 citations· ⚡1
PrivDrift is introduced, a benchmark for auditing whether user-disclosed secrets remain recoverable after conversational topic drift and persuasion-based probing, suggesting that privacy risk in active LLM contexts should be evaluated as a persistent behavioral failure mode rather than only as training-data memorizatio...
ENDOPROMPT is a white-box method that learns utility-degrading prefixes from unlabeled instructions that yields a mean utility change of -26.8 percentage points across four instruction-tuned models and the complete splits of seven benign benchmarks.
Qing-Yuan Wu, Ze-Yu Feng, Yong-Da Yu et al.· 0 citations
PartHackBench provides a certified control for testing whether evaluator credit changes while all benchmark-defined task-relevant progress remains fixed, and provides a certified control for testing whether evaluator credit changes while all benchmark-defined task-relevant progress remains fixed.
RLCDAlignBench is presented, which benchmarks Jev on ten alignment failures: sycophancy, jailbreaks, deception, prompt injection, hallucination, privacy violation, social bias, reward hacking, concealing uncertainty, and power seeking.
Ruo-Qi Guo, Yi Liu, Ge-Lei Deng et al.· 6 citations
Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility—and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research.
Critical flaws, compromised release channels and agentic AI threats landed within days of each other in mid-October 2026. Why “Black October” may say more about how well we now find weaknesses than about the attacks themselves. The post Black October? The Week AI Changed the Cybersecurity Conversation appeared first on GPT-Lab.
