Security papers — 2026-10-26

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Understanding ownership and auditing large language models is becoming crucial as more open-weight checkpoints are released. The most significant work in this area involves creating model-intrinsic weight-level fingerprints, which aims to generate compact fingerprints directly from the spectral structures encoded in LLM parameters instead of relying on query responses or activations. This method, described in Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models, is particularly powerful because it is entirely training-free and requires no input samples or outputs to work.

This approach works by constructing GATE spectral scalar features from the singular-value distributions of GATE projection weights within gated feed-forward networks. These layer-wise features are then aggregated using depth-wise segmented pooling to form a model fingerprint. This representation preserves the coarse layer organization while making comparisons between different LLMs feasible, and its robustness is shown across various modifications like quantization and pruning.

Another area of concern is how privacy can leak during inference, which is addressed by research on exit routing manipulation in multi-exit networks. A malicious cloud service provider can infer sensitive user input properties just by observing the inference latency, a vulnerability detailed in Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks. The authors propose a training framework using selective label smoothing and entropy-covariance optimization to control these confidence distributions across exits, showing that this attack is effective while maintaining acceptable accuracy drops.

Finally, in the realm of data privacy for graph releases, there is work on auditing differential privacy mechanisms. A methodology was developed to empirically audit DP graph release mechanisms by focusing on canary construction and witness statistic selection, as presented in Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study. This toolkit allows researchers to check if claimed privacy guarantees hold true against real-world graph release implementations.

Today's papers

• Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models This method creates fingerprints from the spectral structures within an LLM's weights without needing any training data or input samples. [paper] [episode]
• Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidence This paper critically assesses recent structural attacks on the McEliece cryptosystem to determine their validity and associated costs. [paper] [episode]
• Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks This research shows how a malicious service provider can infer sensitive user input properties by manipulating inference latency in multi-exit networks. [paper] [episode]
• Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study This work presents a new method and toolkit for empirically auditing the privacy guarantees of differentially private graph release mechanisms. [paper] [episode]

The papers

• Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models — The gist The framework constructs compact fingerprints from spectral structures encoded in LLM parameters to derive model-intrinsic, weight-level, and training-free evidence for LLM provenance verification. [episode]
• Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidence — The gist: Structural cryptanalysis of classic McEliece reveals that recent advances in classical structural attacks have progressed significantly, leading to conditional key-recovery estimates that are lower than previously thought, though no practical full-size break has been de [episode]
• Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks — The gist The attack exploits a malicious Cloud Service Provider’s control over model supply chain to infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs. How it works 1. [episode]
• Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study — The gist The authors present a methodology for empirically auditing differentially private graph release mechanisms, identifying two graph-specific design problems: canary construction and witness statistic selection, and demonstrating that this approach can falsify claimed priva [episode]