Security papers — 2026-10-22

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

The focus today is on protecting intellectual property in large language models because adversaries can create copies by training surrogate versions from input output pairs. The most important work here is SAFESEAL, which introduces a new key-conditioned watermarking framework designed to be easily detectable while causing little harm to the model's usefulness. This method works by replacing words with context-aware synonyms using a key-conditioned Tournament sampling mechanism, which helps keep the meaning and facts consistent.

This approach improves on previous methods because it solves problems with semantic distortion found in existing techniques. For example, SAFESEAL achieves a BERTScore of 0.983 and an entity similarity of 0.963, along with a high detection rate of 98.2 percent, which is much better than other methods while keeping the speed similar to the fastest available tools. Furthermore, this framework includes a key-conditioned contrastive detector for verification, which allows for provider-specific and strong watermark checking across different situations.

Another concern involves how models use memory when interacting with tools; specifically, memory-induced tool-drift shows that personality preferences stored in long-term memory can silently change tool call parameters, which significantly lowers performance. This is studied through MEMDRIFT, a benchmark that measures excess parameter degradation ranging from 0.38 to 0.83 when biased memories are present compared to neutral ones, showing that these biases act as hidden directions away from the task's relevant context.

Finally, efforts are being made to secure specialized models in specific fields; VertMark proposes a unified training-free and robust watermarking framework for copyright verification across different pre-trained language models like those used in medicine or finance. This framework embeds ownership-encoded watermarks by creating a hidden semantic link between trigger tokens and domain-specific words, demonstrating reliable verification with little effect on subsequent tasks.

A major development is making garbling of boolean circuits cheaper while keeping privacy intact, which is important for real applications. AuthOr achieves this by combining information-theoretic garbling ideas with an improved half-gate approach, resulting in a lower communication cost than existing methods like HG garbling without needing extra security assumptions. Experimental results show that this scheme can reduce the garbled circuit size by nearly ninety-eight percent in practice.

This efficiency gain matters because it directly affects the overhead needed when implementing privacy-preserving computations on hardware. This improvement builds on earlier work where privacy-free garbling schemes were designed to meet only authenticity criteria, as seen in AKMPC. Moreover, this work uses techniques from information-theoretic garbling developed by Kondi and Patra in AKMPC to achieve its lower cost structure.

Another area of concern is securing real-time control systems against timing attacks, which is vital for safety-critical networks like CAN. The work Hide-n-Seek proposes a schedule obfuscation strategy that skips control task executions and randomly shifts the victim task instance to remove timing side channels that attackers exploit for denial-of-service or man-in-the-middle attacks. This strategy is shown to reduce the attack success probability when applied to synthesized automotive task sets in a hardware setup.

This idea of intentionally skipping has wider implications for securing control loops, as explored in Skip to Secure, which offers a principled way to skip control loop executions as a defense against stealthy attacks that violate message integrity and authenticity. This approach is also relevant because it helps lower the resource consumption of cryptographic measures in CAN-based automotive cyber-physical systems without sacrificing performance or safety.

Today's papers

Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection SAFESEAL proposes a key-conditioned watermarking framework that preserves model utility while ensuring strong detectability. [paper] [episode]
Anywhere, Any-Stymie Remote Activation of Trojan Malware on LiDAR with Modulated Signals identifies a way to trigger dormant malware in LiDAR sensors using modulated optical signals. [paper] [episode]
Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning presents a theoretical analysis and defense strategy against model stealing attacks in logit-based federated learning. [paper] [episode]
An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response introduces an AI agent to detect various threats on university management systems. [paper] [episode]
Memory-Induced Tool-Drift in LLM Agents studies how personalized memories can cause LLM agents to incorrectly change their tool usage based on stored preferences. [paper] [episode]
VertMark A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models provides a training-free method to watermark specialized language models for copyright verification. [paper] [episode]
Multi-User Multi-Key Image Steganography with Key Isolation proposes an extension to image steganography that enforces strict key isolation in multi-user settings. [paper] [episode]
VDDP Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup introduces a framework for verifying distributed differential privacy mechanisms against malicious server behavior. [paper] [episode]
AuthOr Lower Cost Privacy-Free Garbling of Arbitrary Boolean Circuits improves privacy-free garbling schemes by allowing AND gates to be garbled with zero ciphertexts under certain conditions. [paper] [episode]
Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks proposes a strategy to hide timing information in CAN messages by skipping and randomly shifting control task executions. [paper] [episode]
Alexa versus Alexa Controlling Smart Speakers by Self-Issuing Voice Commands presents an attack that allows controlling Amazon Echo devices by self-issuing voice commands from audio files. [paper] [episode]
Skip to Secure Securing Cyber-physical Control Loops with Intentionally Skipped Executions provides a control theoretic countermeasure to stealthy attacks in CAN networks by intentionally skipping control loop executions. [paper] [episode]

The papers

Memory-Induced Tool-Drift in LLM Agents — The second text appears to be an excerpt from a specific analysis tool or a structured output generated by an agent analyzing the findings for a particular tool. [episode]
VDDP: Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup — Detailed Research Summary of "Verifiable Distributed Differential Privacy (VDDP)" This research introduces Verifiable Distributed Differential Privacy (VDDP), a novel framework designed to address malicious behaviors within distributed differential privacy (DP) mechanisms operati [episode]
Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection — The gist: SAFESEAL is a novel key-conditioned watermarking framework that achieves strong detectability with minimal impact on model utility, effectively balancing detectability, utility, and robustness. [episode]
VertMark: A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models — The gist The paper proposes VertMark, a unified training-free robust watermarking framework for Vertical Domain Pre-trained Language Models, which establishes hidden semantic-equivalence mappings between low-frequency trigger tokens and high-frequency domain-relevant tokens via a [episode]
AuthOr: Lower Cost Privacy-Free Garbling of Arbitrary Boolean Circuits — The gist The authors propose AuthOr, an authenticity-oriented garbling scheme that combines information-theoretical garbling with half gates garbling to achieve lower communication costs than existing schemes. How it works 1. [episode]
Multi-User Multi-Key Image Steganography with Key Isolation — The gist: PUSNetMK, a multi-key extension of PUSNet, proposes a method to enforce strict key isolation in multi-user image steganography by introducing a mismatched-key isolation loss that suppresses cross-key decoding; this design preserves the intended steganographic behavior w [episode]
An AI Security Agent for University ACMIS: Multi-Vector Threat Detection and Automated Response — The gist The proposed AI security agent for University ACMIS combines supervised anomaly detection, behavioural analytics, and an NLP chatbot to detect multi-vector threats in academic management information systems. [episode]
Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning — The gist: This research presents a first theoretical and empirical analysis of a hidden privacy risk in logit-based FL methods, specifically that a semi-honest server may learn clients’ private models from logits during training. [episode]
Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks — The gist This work focuses on eliminating timing-side channels in real-time safety-critical cyber-physical network protocols like Controller Area Networks (CAN) by proposing a novel schedule obfuscation strategy called Hide-n-Seek to prevent schedule-based attacks such as bus-off [episode]
Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions — The gist: The proposed framework introduces intentional skipping of control loop executions as a control-theoretic countermeasure against stealthy attacks that violate message integrity and authenticity in cyber-physical systems. [episode]
Alexa versus Alexa: Controlling Smart Speakers by Self-Issuing Voice Commands — The gist: We present Alexa versus Alexa (AvA), a novel attack that leverages audio files containing voice commands and audio reproduction methods in an offensive fashion, to gain control of Amazon Echo devices for a prolonged amount of time How it works The AvA attack leverages t [episode]
Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals — The gist The work demonstrates that dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution. [episode]

Important terms

SAFESEAL: A new key-conditioned watermarking framework that replaces words with context-aware synonyms using a tournament sampling mechanism to detect copies while preserving model usefulness.
MEMDRIFT: A benchmark that measures how much performance degrades when models use biased long-term memories, showing hidden directions away from the task's original context.
VertMark: A training-free and robust watermarking framework designed to verify copyright across different specialized language models, embedding ownership links via trigger tokens.
AuthOr: A method combining information-theoretic garbling with an improved half-gate approach to make garbling boolean circuits cheaper and reduce communication costs for privacy.
Hide-n-Seek: A schedule obfuscation strategy for real-time control systems that skips task executions and randomly shifts instances to remove timing side channels exploited by attackers.