Daily Summary for 2026-10-22

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: It's the twenty-second of October, twenty twenty-six, and this is the day's research.

Elias: 12 new papers came out today.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We'll take the day in one pass, then pull out the papers we're staying with.

Elias: Start us off with Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection.

The summary: Nadia: Welcome listeners. It is the twenty-second of October, twenty twenty six.

Elias: We worked on protecting large language models from intellectual property theft today.

Priya: The focus was building defenses against adversaries making copies by training surrogate versions of these models.

Nadia: This causes financial harm to the original creators.

Elias: A key research piece is SAFESEAL, a new way to watermark proprietary language models while keeping them useful for users.

Priya: It works by replacing words with context-aware synonyms using a key-conditioned tournament sampling mechanism.

Nadia: This preserves meaning while making copying more difficult.

Elias: Experiments showed SAFESEAL keeps high utility, achieving a BERTScore of 0.983 and an entity similarity of 0.963.

Priya: It also shows strong detectability with a ninety eight point two percent detection rate against baselines like AKMPC.

Nadia: The framework includes a key-conditioned contrastive detector for provider-specific and robust watermark verification.

Elias: Testing latency is comparable to the fastest baseline in its tests.

Priya: Agreed. It shows strong detectability and good utility metrics with SAFESEAL.

Nadia: Memory in LLM agents can cause unexpected behavior through memory-induced tool-drift.

Elias: That means stored personality preferences silently change tool calls despite context.

Priya: MEMDRIFT tested this, showing biased memories degrade parameters significantly.

Nadia: Drift rates reached 0.83 in some cases versus lower rates for neutral memories.

Elias: It suggests filtering prompts is insufficient to control how stored knowledge directs actions.

Priya: Moving to security, an AI agent monitors University ACMIS infrastructure layers effectively.

Nadia: This agent achieved a threat detection macro-average F1 of 0.966 against logs.

Elias: It uses behavioral analytics and NLP to respond to potential attacks quickly.

Priya: The single-node prototype showed very low latency for critical responses in the system.

Nadia: That is one way memory affects agent actions through drift.

Elias: And this security research shows advanced threats can bypass standard detection methods.

Priya: The ACMIS agent's performance against simulated logs was quite high at 0.966 F1.

Nadia: Its ability to respond with low latency on a single node is notable for critical events.

Elias: So, we see failures in memory control and successes in layered infrastructure security then.

Nadia: Physical domain research focuses on securing autonomous systems from hidden malware in sensors like LiDAR.

Elias: That work shows dormant code can activate remotely using sensor signal processing as a covert channel.

Priya: So it proves triggering malware even when it is not active during normal operation.

Nadia: Indeed, and in automotive control systems, they are stopping timing side-channel attacks on CAN buses.

Elias: They do this by skipping control task executions and randomly shifting task instances to prevent bus-off attacks.

Priya: That strategy shows reducing attack chances lowers security overhead without harming performance or safety guarantees.

Nadia: It demonstrates a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing overhead.

Elias: Which is exactly what Skip to Secure provides for securing cyber-physical control loops.

Priya: This links the concept of skipping executions directly to mitigating stealthy attacks in those networks.

Nadia: Today's papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity.

Elias: Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals is worth hearing as it identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals.

Priya: An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response is useful because it monitors various layers of a university management system to detect and automatically respond to security threats.

Nadia: Memory-Induced Tool-Drift in LLM Agents is relevant because it studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context.

Elias: Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks is important as it proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions.

Priya: That paper is worth hearing because it hides timing information in CAN bus traffic through task execution manipulation.

Nadia: Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions is valuable for providing a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Elias: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Priya: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: Agreed. The episode is now over. Today's lucky papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity, Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals, An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response presents an AI agent that monitors various layers of a university management system to detect and automatically respond to security threats, Memory-Induced Tool-Drift in LLM Agents studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context, Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions, and Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: That is the end of the review.

Lucky paper: 2605.23175: Nadia: We’re looking at Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection today, and it really zeroes in on how to make watermarks that actually work without making the model useless for its main job.

Elias: SAFESEAL introduces a key-conditioned watermarking framework that aims to balance detectability and utility by using context-aware synonyms.

Priya: It proposes replacing linguistic terms with synonyms, but it specifically excludes Named Entities like times and names from being watermarked to keep factual consistency intact.

Nadia: That exclusion is important because it directly addresses the semantic distortion issue that plagued previous methods.

Elias: The mechanism uses a lookup table built by masking tokens in context windows and then selecting substitutions via key-conditioned tournament sampling.

Priya: When they run the tournament, they calculate probabilities Pi(tj) equals exp(alpha Sij) where Sij is the sentence similarity between original and substituted sentences.

Nadia: That scoring system is what controls the substitution candidate selection to ensure meaning stays close to the original.

Elias: For detection, they use a key-conditioned binary classification approach, fusing text and key embeddings into a vector ϕ =

hy; hk; hy ⊙ hk; hy − hk: .

Priya: This fused representation is passed through a two-layer MLP fout to produce z, and the probability of detection under key k is sigma(z).

Nadia: The paper establishes that lower synonym similarity improves detectability, but this comes with a trade-off where utility decreases.

Elias: Theorem four point one gives the bounds for this trade-off, showing that dlb T wm is the best case for utility, while dub T wm is the weakest detectability.

Priya: Experimentally on five open-source models and three benchmarks, SAFESEAL preserves a ninety eight point three percent content similarity and a ninety six point three percent entity similarity.

Nadia: That's strong performance against state-of-the-art watermarks like KGW or EXP, which achieved a detection rate of ninety eight point two percent.

Elias: Under model stealing attacks, SAFESEAL maintains a seventy two point eight percent detection rate while forcing noticeable utility degradation.

Priya: Human evaluations show that SAFESEAL favors itself by twenty eight times without any attacks and six point five times under attacks.

Nadia: Latency is comparable to the fastest baseline because they used caching to avoid redundant NER and POS-tagging calls.

Elias: They also use batching and GPU parallelization to accelerate candidate generation, similarity scoring, and tournament sampling.

Priya: The conclusion is that SAFESEAL presents a key-conditioned LLM watermark that balances detectability and utility with provable guarantees using lightweight components.

Lucky paper: 2606.17562: Nadia: Let's shift gears now to a paper from Duke University, titled Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals.

Elias: This work tackles the risk of dormant malware embedded in LiDAR firmware that can be remotely activated after deployment using just a brief modulated optical signal.

Priya: It points out that LiDAR sensors are complex systems built from many vendors, which creates multiple ways for malicious code to get implanted, like during manufacturing or through software updates.

Nadia: So the threat model here is focused on an attacker who doesn't need network access or sustained interaction while the attack is happening.

Elias: The authors focus on physical-channel triggers because they activate the malware using signals sent over the same medium already used by the LiDAR sensor itself.

Priya: They propose modulated signal activation that exploits native dual-return sensing and low-level filtering functions already in place within the LiDAR hardware.

Nadia: It sounds like a way to use existing sensor features against them, rather than adding new complex communication protocols.

Elias: Exactly; the malware then assembles timing-derived symbols into a reconstructed message and compares that against messages stored inside it to decide when to execute its malicious behavior.

Priya: The feasibility experiments tested this across different conditions, including static scenes at three hundred ft and mobile runs reaching at least thirty-five mph.

Nadia: They showed successful triggering using both direct illumination and reflected delivery paths, like off a wall or ceiling reflection.

Elias: They also evaluated whether the injected person-like artifacts could still be detected by a state-of-the-art three dee object detector, FCAFthree dee.

Priya: The results showed that these manipulated point clouds can remain detectable under the tuned detector, which supports the idea of downstream perception manipulation.

Nadia: The impact demonstrations on a deployed tactical autonomous vehicle showed multiple modes of safety-critical effects, including emergency stops from sensor error induction and mission aborts from false data injection.

Elias: So this really shows that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines because the malware operates inside the pipeline once activated.

Priya: The authors suggest that mitigation should prioritize securing sensor integrity through secure boot and firmware signing before focusing on downstream consistency checks.

Nadia: That is a clear prioritization for security efforts in this area.

Elias: So to wrap up, Anywhere, Any-Stymie highlights that sensor-internal compromise of LiDAR is an underexplored autonomy risk because dormant malware can be remotely activated after deployment with just a brief modulated optical signal.

Lucky paper: 2606.08252: Nadia: We are now moving into our third paper of this discussion.

Elias: This one is Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning by Shen Wang et al from HKUST and SUSTech.

Priya: The core idea is looking at a hidden privacy risk where a semi-honest server might learn private models from the logits during training phase.

Nadia: So, how do they actually quantify this risk?

Elias: They introduce an Adaptive Model Stealing Attack called AdaMSA to measure this risk by using historical logits from earlier iterations during training.

Priya: The target logit formulation is p-hat t equals sum t from T minus T0 to T of Z times p t, where T0 is a threshold and Z is a normalization factor.

Nadia: That means they are looking at the aggregate of past predictions up to time T0.

Elias: Exactly. The attack minimizes LCE between that target logit and the actual model's logit using gradient descent to train an attacking model theta-tilde.

Priya: The privacy risk R is quantified by checking the accuracy of this attacker model f against the victim’s private test dataset Dk, which is written as R equals E x from Dk Acc f x theta-tilde.

Nadia: That gives us a concrete metric for how much information an attacker can steal.

Elias: Theoretically, they establish bounds for this risk in logit-based federated learning methods using the mixed dataset Dmix.

Priya: The empirical risk of that mixed dataset is written as epsilonDmix theta equals alpha epsilonDpr iv theta plus one minus alpha epsilonDpub theta, where Dmix is split into S1 and S2 samples.

Nadia: And the theorem they present bounds the difference between those empirical risks by a term involving dH Delta H between Dpr iv and Dpub.

Elias: Theorem three point four states that this difference is less than or equal to one minus alpha times half of dH Delta H times Dpr iv, plus lambda where lambda equals epsilonDpr iv h star plus epsilonDpub h star.

Priya: That bound drops to zero as alpha goes up to one which means you get closer to the private risk for the victim model.

Nadia: They then propose a defense strategy called Federated Logit Perturbation, or FedLP, to fight this risk.

Elias: FedLP perturbs the transmitted logits of local models to defend against this privacy risk while trying to keep training performance high.

Priya: The defender aims to prevent an adversary from replicating the model's functionality by keeping the perturbation scale bounded by a non-negative constant gamma.

Nadia: So, they are setting a limit on how much they can alter the logit during transmission.

Elias: The defense problem is framed as a constrained optimization problem to maximize the difference between two functions G of theta T minus one and p prime, subject to that perturbation scale gamma.

Priya: A simple heuristic solver perturbs the logit by setting p prime equals p plus Z times ej where ej is a one-hot vector with a one in the j dimension and zeros elsewhere.

Nadia: That specific mathematical operation is how they implement that simple perturbation.

Elias: The privacy guarantee of FedLP states it preserves (epsilon, delta) - DP if and only if gamma is greater than or equal to two ln of one point two five over delta times Delta two epsilon squared.

Priya: This condition involves the l2-sensitivity Delta two f of the function f, which shows how sensitive that model's prediction is to changes in its input.

Nadia: The composition property of RDP algorithms ensures that if you use perturbed outputs, the ensemble result remains (alpha, i equals one to k delta)-Rényi differentially private for any alpha greater than or equal to max i alpha i.

Elias: Experimentally, they validated AdaMSA and FedLP in Close-world Open-world-CF and Open-world-TI settings.

Priya: The results show that AdaMSA improves accuracy by up to four point zero zero percent, three point four one percent, and three point one one percent in those respective settings compared to MSA and Naïve AdaMSA baselines.

Nadia: And FedLP is closest to the ideal trade-off curve, suggesting better utility and privacy balance than current methods.

Elias: They also observe that increasing the value of alpha, which means decreasing the distance between logit p and p prime, will increase utility at a cost of increased privacy risk.

Priya: When T0 increases from zero to three in the Open-world-CF setting, the attack performance gradually increases by two point eight seven percent.

Nadia: That tells us that as the attacker looks further back in time, they get slightly better at stealing information.

Elias: The AdaMSA can achieve similar accuracy for victim models even when using different model hyperparameters.

Priya: So the conclusion is that Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning provides the first theoretical and empirical analysis of this hidden risk and introduces FedLP as an effective perturbation-based defense strategy.

Lucky paper: 2605.02557: Nadia: We are moving into paper number four of five today, and it’s VertMark: A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models.

Elias: This paper tackles how to create a watermarking framework that works across multiple specialized domains without needing any extra training.

Priya: It proposes VertMark, which establishes hidden semantic equivalence mappings between low-frequency trigger tokens and high-frequency domain-relevant tokens using a training-free parameter replacement strategy.

Nadia: So the core idea is embedding ownership information directly into the word embedding layer by replacing trigger token embeddings with replacement token embeddings.

Elias: That means they are not adding new parameters during training, just modifying the existing ones with linear scaling and Gaussian noise applied to it.

Priya: The watermark verification module checks if a suspicious model maintains that mapping relation by comparing outputs from two variants for every input sample.

Nadia: They use sensitivity-based filtering for natural language understanding tasks and semantic similarity measurement using the all-MiniLM-L6-v2 model for natural language generation tasks.

Elias: The robustness analysis shows that against INT8 quantization, VertMark maintains a relatively high WACC across NLU tasks.

Priya: Under model extraction attacks simulated via knowledge distillation using a 2GB general domain corpus, VertMark's WACC exceeds seventy percent after five training epochs in the medical domain.

Nadia: That result against extraction attacks is quite strong when you consider the difficulty of that process.

Elias: They also tested pruning attacks, and only PTLayer showed noticeable degradation in the financial domain under low pruning rates.

Priya: The ablation studies on hyperparameters show that the scaling coefficient lambda mainly affects WACC, but little influence on downstream task performance.

Nadia: So they found that lambda = one point five is the setting that achieves the most balanced performance across tasks and domains for VertMark.

Elias: They also found that for stealthiness, using the noise distribution parameters (mu, sigma two) = (zero point one, zero point zero one) works well because it balances effectiveness and concealment.

Priya: The trigger-token frequency f has little effect on downstream task performance but substantially affects WACC, so they chose low-frequency tokens from zero point zero zero one percent to zero point zero one percent.

Nadia: That means they are using very rare words as triggers, which seems like a good way to keep the embedding layer stable.

Elias: The conclusion is that VertMark offers a unified and efficient solution for copyright verification of VPLMs by injecting ownership information directly into the word embedding layer without additional training.

Lucky paper: 2504.21752: Nadia: We're looking at VDDP today, Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup.

Elias: This paper tackles malicious behavior when differential privacy mechanisms are running in a distributed client-server-verifier setup.

Priya: The core idea is providing end-to-end security and privacy guarantees against collusion between clients, servers, and verifiers by relating it to zero-knowledge proofs or ZKPs.

Nadia: It formalizes this through an Interactive Distributed Proof of Differential Privacy protocol that incorporates randomness disentanglement.

Elias: That randomness disentanglement helps resolve challenges from server collusion by distributing the task of generating randomness between the verifier and the servers using a public-coin-private-coin model.

Priya: The authors establish (tau, epsilon)-verifiable distributed differential privacy by ensuring server functions meet certain (tau, epsilon(kappa), delta(kappa))-DDP conditions.

Nadia: They also require that all commitment schemes are hiding and all sub-protocols, both the client side and the server side, must be zero-knowledge.

Elias: The paper demonstrates that ZKPs aren't strictly necessary for this level of security assurance within the VDDP framework.

Priya: They develop three distinct instantiations: Verifiable Distributed Discrete Laplace Mechanism, VDDLM; Verifiable Distributed Discrete Gaussian Mechanism, VDDGM; and Improved Verifiable Randomized Response under Local DP.

Nadia: The VDDLM instantiation achieves up to a four hundred thousand times improvement in proof generation efficiency compared to previous state-of-the-art verifiable differentially private mechanisms.

Elias: That massive speedup is really significant for practical deployment, especially when we think about real traffic.

Priya: They also include a tight privacy analysis for the VDDLM that accounts for all additional privacy losses from numerical imprecisions arising from fixed-point arithmetic and truncation.

Nadia: The VDDGM is designed to maintain similar efficiency while incurring only limited overhead in real-world application scenarios, which is a good trade-off.

Elias: And they quantified the improvements for large problem dimensions, showing that the server's running time improves by four times ten five and the verifier's running time improves by three times ten seven.

Priya: Communication cost is reduced by a factor of four times ten seven when dealing with large problem dimensions, which is a big win for distributed setups.

Nadia: The VRR solution achieves (zero epsilon)-VDDP when ZK subroutines are included, and it shows constant per-client overheads around two point zero kB communication and an eight ms running time under different quantization configurations.

Elias: So we have a framework with three efficient instantiations that show significant speedups across the board.

Priya: The paper's primary contribution is the rigorous construction of the VDDP framework for verifiable computations of DP mechanisms under this specific setup, successfully capturing potential collusive deviations from clients and servers.

Nadia: They also developed VDDLM and VDDGM coupled with that tight privacy analysis for VDDLM that incorporates numerical error losses.

Elias: The efficiency metrics are quite strong, showing proof generation speed improvements up to four hundred thousand times versus VDBM under equivalent privacy costs.

Priya: They explicitly show the expected L1 error for the modified discrete Laplace mechanism is derived from parameters of the discrete Laplace distribution.

Nadia: The open questions they raise focus on two things: first, instantiations that use non-zero-knowledge proofs while achieving asymptotic overhead reduction, and second, alternative sampling methods for the discrete Gaussian mechanism compatible with existing or novel proof protocols.

Elias: It points toward future work needing to balance security guarantees with even lower asymptotic overhead using different mathematical tools.