The paper presents a deep‑learning approach for detecting cyberattacks in Low‑Earth Orbit satellite systems, leveraging the UNSW‑IoTSAT dataset. It explores structured architectures that preserve hardware, orbital, and radio‑frequency data, including a Subsystem‑Fusion MLP and a hierarchical multimodal Transformer that captures cross‑subsystem interactions and temporal dynamics. Experiments show that the hierarchical Transformer achieves up to 91.66% accuracy and 85.63% macro F1 under a leakage‑resistant evaluation protocol, highlighting the importance of multimodal modeling and rigorous testing.
By Kyle Stein, Guillermo Francia III, Eman El-Sheikh, Hossain Shahriar
arXiv:2605. 13922v2 Announce Type: replace-cross Abstract: During thDuring the last few years, the term Mechanistic Interpretability, a specific area, under the umbrella of explainable artificial intelligence (XAI), has been introduced, to explain the decisions made by complex machine learning (ML) models in critical systems like UAV intrusion detection systems (UAVIDS).
By Iakovos-Christos Zarkadis, Christos Douligeris
arXiv:2606. 18454v1 Announce Type: cross Abstract: We present Veriphi, a GPU-accelerated neural network verification system that combines fast adversarial attacks with formal bound certification using alpha,beta-CROWN methods.
By Pratik Deshmukh, Kartik Arya, Vasili Savin
The paper proposes a new unsupervised safety detection method for large language models that relies on anomaly detection rather than supervised training on unsafe data. By leveraging local sparsity in a linear representation space obtained via a sparse autoencoder, the authors develop a framework for locally masked SAE-based anomaly detection, providing theoretical support and empirical validation across multiple architectures and datasets. When calibrated with only 1% out-of-distribution data, the method achieves near‑optimal performance while using just 1–2% of SAE neurons for computation.
By Xin Chen, Gil Kur, Alexander Shevchenko, Andreas Krause
The paper introduces the Temperature Scaling Attack (TSA), a training‑time method that degrades model confidence calibration while keeping predictive accuracy largely intact. TSA injects temperature scaling with a learning‑rate coupling during local federated training, shifting confidence scores and causing significant calibration errors (e.g., a 145% increase on CIFAR‑100) with less than a 2% drop in accuracy. The authors provide a convergence analysis for non‑IID settings and demonstrate TSA’s effectiveness across three benchmarks, robust aggregation, and post‑hoc calibration defenses, highlighting its impact on mission‑critical systems such as healthcare verification and autonomous driving.
By Kichang Lee, Jaeho Jin, JaeYeon Park, Songkuk Kim, JeongGil Ko
arXiv:2604. 02478v2 Announce Type: replace Abstract: Deep learning models excel at detecting anomaly patterns in normal data.
By Jiyong Kwon, Ujin Jeon, Sooji Lee, Guang Lin
SPADE is a labelled, multi‑modal, simulation‑based dataset for detecting attacks on Signal Phase and Timing (SPaT) messages from the perspective of connected vehicles. It contains 1.89 million timestep records generated by injecting six classes of application‑layer attacks and one benign class into the SAE J2735 SPaT protocol, across multiple intersection geometries, operating conditions, and random seeds. Each record fuses SPaT fields, onboard camera confidence scores, and cooperative V2V peer data into 40 features, enabling deep‑learning intrusion detection systems to distinguish deliberate attacks from environmental noise.
Federated learning (FL) enables aircraft fleet operators to jointly train remaining-useful-life (RUL) models from engine sensor telemetry without sharing raw data. This study examines two complementary challenges: benign heterogeneity, where honest operators observe different operating conditions and fault modes, and adversarial heterogeneity, where compromised operators submit poisoned updates.
arXiv:2608. 04045v1 Announce Type: cross Abstract: Federated learning (FL) enables aircraft fleet operators to jointly train remaining-useful-life (RUL) models from engine sensor telemetry without sharing raw data.
By Chinmoy Mitra, Md. Mehedi Hasan Nipu, Mohammad Sakib Mahmood, Md. Rakibul Islam, M. F. Mridha
The paper proposes a novel unsupervised safety detection method for large language models that relies on local sparsity in a linear representation space recovered via a sparse autoencoder. By masking SAE neurons based on shared active support among nearby points, the authors develop a locally masked anomaly detection framework with theoretical backing. Experiments across multiple architectures and datasets—including capability‑testing and safety‑specific sets—show that using only 1–2% of SAE neurons and a small amount of out‑of‑distribution data yields near‑optimal safety detection performance.
The paper introduces SPADE, a labelled, multi‑modal dataset for detecting attacks on Signal Phase and Timing (SPaT) messages from the perspective of connected vehicles. Generated via Eclipse MOSAIC, SPADE includes 1.89 million timestep records across six attack classes and one benign class, combining SPaT fields, camera confidence scores, and V2V peer data over 40 features. The dataset, along with generation code and scenario configurations, is publicly released on GitHub to enable reproducible deep‑learning intrusion detection research in C‑V2X security.
By James Di Novo, Hany Ragab, Sylvain P. Leblanc
arXiv:2609.14593v1 Announce Type: cross
Abstract: Living-Off-the-Land (LOTL) is the dominant evasion technique of Advanced Persistent Threat (APT) actors, exploiting legitimate Windows utilities to c...
By Ahad Bin Islam Shoeb, Kamrul Hasan, Jamal Uddin Tanvin, Liang Hong, Imtiaz Ahmed, Md Arif Billah, Al Amin