Security papers — 2026-10-25

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today's work centers on understanding how we can adapt AI models to improve their performance in real-world security tasks, which is crucial because it moves beyond static models to something more responsive. We looked at how steering emotion directions within a 4 billion parameter cybersecurity transformer, called AKMPC, could boost its ability to handle cyber threats. The findings showed that nudging the model toward calm or desperate states improved its performance by about one and a half to two percentage points across various tests, suggesting emotion representations are controllable tools for adaptive reasoning.

Another important area is how large reasoning models can expose private location data through visual clues, which is a serious privacy concern. The GeoTrace attack showed that models like Gemini-3-Flash localize ordinary images within one kilometer about twenty-six percent of the time, and this localization relies heavily on small, distinctive local clues rather than broad scene properties. To counter this, the GeoShift defense works by preserving stable scene features and rewriting revealing clues to suggest an alternative location, which successfully reduced street-level localization significantly.

We also examined how multimodal models can be tricked into bypassing safety checks, as shown by Mirage, which demonstrated that imperceptible perturbations can align an image with a malicious target while evading various post-generation safety checkers across different diffusion models. On the resource side, we saw how LLM-based scam systems can be disrupted by TokenTrap, which redirects suspected fraud attempts toward low-value computations by amplifying token consumption dramatically across different agent workflows.

Finally, there is the issue of data voids in web searching LLMs; this means disinformers can succeed even with just one controlled page because the model relies on sparse information when answering data-void prompts. While user prompts offer slight protection, we found that attacker content appears in responses thirty-one percent of the time under various conditions, highlighting a need for defenses against this inference-time manipulation.

The most pressing issue seems to be how to make large language models useful in real-world settings where resources are limited, which is addressed by the work on parameters efficient language model with latent cross-attention for IoT intrusion detection. This work matters because it shows that we can create a model small enough to run on tiny devices while still being accurate enough for security tasks.

This approach compresses the input into a small latent space before using a minimal Transformer core, and by comparing nine compression configurations against SecurityBERT on two datasets, the authors found their model is about seven times smaller than SecurityBERT but achieves similar or better performance in intrusion detection metrics. This suggests that lightweight Transformer architectures can be practical for security monitoring on resource-constrained IoT devices.

The work on PhishGen is also significant because it tries to measure the actual capability of LLMs when generating phishing websites, moving beyond just visual inspection. PhishGen constructs prompts across various modalities and generates pages using fourteen different LLMs, assessing them against sixty-four real-world kits; although most outputs render, only a fraction complete the full credential-harvesting pipeline.

This is complemented by research on watermarking generated text to track its origin, as seen in HiMark. HiMark proposes a framework that uses hierarchical mechanisms during embedding and model-agnostic evidence aggregation during detection to improve watermark extraction accuracy while preserving text quality under paraphrasing attacks.

Finally, the work Who Patches the Lightning Network? provides insight into how network maintenance actually occurs, showing that upgrades happen based on platform releases rather than security disclosures, which contrasts with expectations about when patches are deployed.

Today's papers

The papers

Important terms

Emotion Steering
Controlling a model's emotional state, like nudging it toward calm or desperation, to improve its performance in security tasks. This shows that emotion representations can be used as a controllable tool for adaptive reasoning in AI.
GeoTrace Attack
A privacy risk where large models can reveal private location data from ordinary images by using small local clues. The defense involves rewriting these revealing clues to suggest an alternative location.
Mirage Attack
A method where imperceptible changes to an image can trick multimodal models into bypassing safety checks and aligning the image with a malicious target. This highlights vulnerabilities in post-generation safety checkers.
TokenTrap
A disruption technique for LLM-based scam systems that redirects fraud attempts toward low-value computations by massively increasing token consumption across various agent workflows.
Parameter Efficient Language Models (PE LMs)
Creating smaller language models with latent cross-attention to run on tiny devices while maintaining accuracy. This makes LLMs practical for security monitoring on resource-limited IoT devices.