arXiv:2606. 21900v2 Announce Type: replace-cross Abstract: Continuous authentication for mobile and zero-trust systems requires nonintrusive evidence confirming the enrolled user-device context remains valid after initial login.
arXiv:2608. 16334v1 Announce Type: new Abstract: Keystroke dynamics (typing patterns) can be used as a behavioural biometric modality for user authentication, with applications such as fraud prevention.
arXiv:2609.22724v1 Announce Type: cross Abstract: Mobile agents powered by foundation models now automate complex, multi-step workflows on real devices, but their trajectories can violate app-specifi...
MobileWorldSafety is a benchmark that evaluates the safety of large language model–powered GUI agents on Android by exposing them to 142 real-world risk tasks involving environmental injection attacks. The benchmark uses a two‑stage verification pipeline—rule‑based checks for clear cases and an LLM judge for ambiguous ones—to distinguish safety failures from capability failures. Experiments on six agents show high vulnerability, with attack success rates between 40.4% and 66.9%, highlighting that current agents often fail to remain safe when faced with adversarial content presented as normal mobile context.
arXiv:2605. 09028v3 Announce Type: replace Abstract: Machine learning-based Android malware detectors often fail in real-world deployment due to domain shift, where models trained on one data source perform poorly on applications from another.
arXiv:2607. 11649v1 Announce Type: cross Abstract: Network-based anomaly detection for IoT devices has matured to the point of reporting strong detection accuracy, yet most published systems stop at raising an alert and leave the question of automated enforcement to future work or to a programmable data plane that few real networks operate.
RouteScan is a non‑intrusive auditing framework that detects harmful behavior in Mixture‑of‑Experts (MoE) large language models by analyzing expert‑routing telemetry captured from GPU execution. It uses the number of active GPU threads during the prefilling phase as a micro‑architectural fingerprint to isolate cross‑domain risk indicators and precisely identify malicious prompts. Evaluations on four open‑source MoE LLMs show strong generalization with AUROC > 0.91 on unseen harmful domains, while privacy tests indicate that full prompts cannot be reliably recovered from aggregated telemetry.
CPU-Auth is a novel authentication method that uses unique variations in a device’s CPU, measured via the Dynamic Voltage and Frequency Scaling (DVFS) governor from a browser, to create a hardware-based device fingerprint. The approach is evaluated on over 50,000 data traces using distance‑based and deep learning techniques. The study highlights how CPU-Auth could serve as a secondary authentication factor, addressing flaws in existing methods such as SMS, biometrics, and token‑based systems.
arXiv:2608. 19938v1 Announce Type: cross Abstract: Existing approaches to anomalous behaviour log detection, such as Wazuh rely primarily on predefined detection rules, while statistical anomaly detection approaches such as OpenSearch identify deviations from previously observed behavioural patterns.
arXiv:2608. 14826v1 Announce Type: cross Abstract: The wireless networks have historically faced significant security vulnerabilities, necessitating advanced anomaly detection mechanisms, especially as networks evolve towards 6G and beyond.
PocketTSLM is a mobile-native deployment of the OpenTSLM SoftPrompt time‑series language model that runs entirely on a consumer smartphone. By injecting encoded time‑series windows as embeddings instead of tokenizing them as text, PocketTSLM preserves temporal structure while using far fewer tokens and staying within the device’s context and memory limits. The model has been benchmarked on 30‑second EEG sleep‑staging clips and 10‑second ECG recordings, achieving on‑device inference with no health data transmitted to the cloud.
The paper proposes an identity‑agnostic approach to multi‑user WiFi sensing that reframes activity recognition as counting how many users perform each activity, rather than assigning actions to specific individuals. Using WiMANS data, the identity‑agnostic counting model outperforms identity‑dependent predictions on integer‑count mean absolute error across all tested environments, and remains robust when users are unseen. Embedding analysis shows that identity‑agnostic representations cluster by activity composition instead of user identity, supporting the claim that counting is a more accurate and robust scene‑level estimation method.
The paper presents a comprehensive benchmark for Domain Generalization (DG) in smartphone-based Human Activity Recognition (HAR), running over 410,000 experiments across multiple architectures, training objectives, initialization strategies, and architectural tweaks. It finds that individual DG components offer limited, highly conditional improvements, while combined configurations often yield stronger, sometimes super‑additive gains that depend on the model and shift scenario. The study also highlights that current source‑validation selection captures only a fraction of the potential oracle performance, underscoring the need for joint DG design and robust model‑selection methods.