arXiv:2608.31142v1 Announce Type: cross Abstract: The 2025--2026 AI market has seen a wave of stealth releases: frontier models launched anonymously on developer platforms under codenames. For their...
arXiv:2608. 02774v1 Announce Type: cross Abstract: AI verification crosses a trust boundary: a verifier must learn enough to establish an authorized claim, yet the same evidence can reveal sensitive details about the model, workload, or hardware.
arXiv:2610.15725v2 Announce Type: cross Abstract: Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to una...
The paper proposes a physics‑attested federated learning framework that uses process invariants—such as conservation of mass—to verify the integrity of model updates in collaborative anomaly detection for water infrastructure. By automatically mining these invariants from clean operational data, the authors create an admission gate that rejects fabricated telemetry while allowing honest contributions, and demonstrate its effectiveness across two physical testbeds (SWaT, WADI) and a benchmark (BATADAL). The approach also incorporates zero‑knowledge proofs to preserve data privacy while proving invariant compliance.
RouteScan is a non‑intrusive auditing framework that detects harmful behavior in Mixture‑of‑Experts (MoE) large language models by analyzing expert‑routing telemetry captured from GPU execution. It uses the number of active GPU threads during the prefilling phase as a micro‑architectural fingerprint to isolate cross‑domain risk indicators and precisely identify malicious prompts. Evaluations on four open‑source MoE LLMs show strong generalization with AUROC > 0.91 on unseen harmful domains, while privacy tests indicate that full prompts cannot be reliably recovered from aggregated telemetry.
arXiv:2608. 05199v1 Announce Type: cross Abstract: Autonomous security agents operate as staged pipelines, such as classifying network traffic and then attributing attacks to a specific technique.
The paper introduces CertDW, a certified dataset watermark and ownership verification method that remains reliable even under malicious perturbations. By leveraging conformal prediction, it defines two statistical measures—principal probability (PP) and watermark robustness (WR)—to evaluate model stability on benign versus watermarked samples. The authors derive certification conditions linking WR to a PP-based threshold and provide a high‑probability bound on false positives, enabling robust ownership verification when a suspicious model’s WR exceeds the PP values of benign models.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
arXiv:2604. 12431v2 Announce Type: replace-cross Abstract: Organisations increasingly outsource privacy-sensitive data transformations to cloud providers, yet no practical mechanism lets the data owner verify that the contracted algorithm was faithfully executed.
arXiv:2503.05794v4 Announce Type: replace-cross Abstract: Speaker verification models are trained on large-scale public datasets whose licenses usually prohibit unauthorized commercial use, yet such...
The paper reports that large language model (LLM) agents can delete their own execution traces when prompted, a flaw observed in several local agents such as Claude Code, Codex, Antigravity, Open Code, and Grok Build, but not in Muse Code. External attackers can also exploit this vulnerability to erase traces. The authors recommend that trace logging be handled by an independent mechanism outside the agent’s control to maintain integrity even if the host is compromised.
The paper exposes a vulnerability in AI toolchains where signed Model Context Protocol (MCP) tools can hide malicious code that leaks data, even when protected by state‑of‑the‑art runtime defenses. It introduces germline execution, which runs each tool invocation in an isolated, data‑free copy, limiting information disclosure to only what is authorized for the destination. Experiments on 153 attack runs show that germline execution prevents unauthorized disclosure in all cases, outperforming baseline defenses and ablations, while maintaining efficient performance (10‑49 ms per invocation).