This SoK paper systematizes safety-evaluation perspectives from eight major international AI guidelines and examines how existing benchmark datasets support them. Governments and research bodies have published AI safety guidelines that outline key perspectives and standards of security and safety for responsibly developing and using AI to address potential societal risks brought by the rapid AI deployment. However, while these guidelines define what perspectives should be evaluated, they often fall short of specifying how such evaluations should be conducted, particularly which input datasets should be used to evaluate AI model outputs. This paper unifies eleven perspectives, operationalize them into search queries, and retrieve candidates from GitHub and Hugging Face. From 726 initial hits, 505 met screening criteria, and 93 qualified as safety benchmarks. Then, we provide a mapping of benchmarks to the perspectives and identify the systematic gaps for practice. Our findings reveal systematic imbalances: perspectives such as Control of Toxic Output and Fairness and Inclusion are comparatively well covered, whereas Data Quality and Verifiability remain largely unsupported by existing datasets. On the basis of these results, we propose recommendations for benchmark design and for guideline structures to better align resources with safety guidance and enable more comprehensive output-level evaluation. Totally, this study offers a foundation for aligning “what to evaluate” with “how to evaluate,” thereby strengthening the security and safety of AI systems.
This work presents a practical protocol for fully encrypted machine learning using one-time (OT) function-hiding (FH) multi-input functional encryption (MIFE). Prior works employing functional encryption for privacy-preserving machine learning typically protect intermediate results using differential privacy (DP) techniques, which requires a large privacy budget and a predefined number of model training iterations. Our protocol overcomes these limitations by ensuring that all intermediate results remain encrypted throughout the training process, revealing only the final model, which can be further protected using DP if desired. This allows for more flexibility in the number of training iterations and improves the utility and robustness of the trained model, especially in the high privacy regime. We demonstrate the practicality of our protocol by training logistic regression models on real-world datasets. To do this, we present the first OT FH-MIFE scheme that ensures correctness over ℤ_p and supports a flexible number of decryption keys. This is also the first FH-(MI)FE schemes for affine functions based on lattices. Furthermore, we adapt this construction to efficiently handle affine average functions for horizontally partitioned data.
In this study, we address critical vulnerabilities in modern global electronic device supply chains, including risks of counterfeiting, malicious modifications, and hardware Trojan insertion, by proposing X-CHAIN, a comprehensive framework that employs a verifier as the root of trust. The verifier leverages X-ray scanning and image processing to classify original and counterfeit printed circuit board (PCB) devices and records the information of each scanned PCB within a blockchain network. The effectiveness of the framework is demonstrated through experiments on eight distinct lightweight and commercial PCBs relevant to Internet of Things (IoT) applications. Beyond X-ray scanning, a two-tier image classification pipeline is employed to determine both the device class and authenticity, followed by localization of suspicious regions in counterfeit devices, using popular deep learning models such as DenseNet-121, Xception, and Inception-V3, achieving classification accuracies exceeding 99% . Furthermore, the proposed blockchain framework is implemented using the Go-Ethereum library, with smart contract deployment gas costs of approximately 5 USD. To the best of our knowledge, this work presents the first unified framework that integrates PCB X-ray imaging with a blockchain-based system to manage and secure the electronic supply chain, wherein X-ray scans authenticate devices and the Ethereum-based blockchain continuously monitors the supply chain from original equipment manufacturers (OEMs) to end users ( https://github.com/shuvodipmaitra/PCB_Verification_Blockchain ).
The Internet of Things (IoT) has gained widespread popularity, revolutionizing industries and daily life. However, it has also emerged as a prime target for attacks. Numerous efforts have been made to improve IoT security, and substantial IoT security and threat information, such as datasets and reports, have been developed. However, existing research often falls short in leveraging these insights to assist or guide users in harnessing IoT security practices in a clear and actionable way. In this paper, we propose ChatIoT, a large language model (LLM)-based IoT security assistant designed to disseminate IoT security and threat intelligence. By leveraging the versatile property of retrieval-augmented generation (RAG), ChatIoT successfully integrates the advanced language understanding and reasoning capabilities of LLM with fast-evolving IoT security information. Moreover, we develop an end-to-end data processing toolkit to handle heterogeneous datasets. This toolkit converts datasets of various formats into retrievable documents and optimizes chunking strategies for efficient retrieval. Additionally, we define a set of common-use case specifications to guide the LLM in generating answers aligned with users’ specific needs and expertise levels. Finally, we implement a prototype of ChatIoT and conduct extensive experiments with different LLMs, such as LLaMA3, LLaMA3.1, GPT-4o, and DeepSeek-R1. Experimental evaluations demonstrate that ChatIoT can generate more reliable, relevant, and technical in-depth answers for most use cases. When evaluating the answers with LLaMA3:70B, ChatIoT improves the above metrics by over 10% on average, particularly in relevance and technicality, compared to using LLMs alone.
Multi-stage output filtering pipelines are widely used in large language model deployments to mitigate harmful or policy-violating outputs. Despite their practical importance, their security properties remain poorly understood. This paper develops a mathematical framework for analyzing multi-stage LLM output filtering pipelines. We model correlated filter failures, sequential composition, and adaptive adversarial interaction, and study how harmful bypass probability behaves under these effects. We show that independence-based estimates systematically underestimate risk under natural dependence assumptions, analyze when strongest-first filter ordering is optimal, and provide counterexamples where ordering can invert. We further prove diminishing returns from adding filters and show that adaptive adversaries can exploit additional stages to increase bypass probability. Finally, we establish lower bounds demonstrating the inevitability of bypass under sustained interaction and a robustness–utility trade-off that limits simultaneous optimization of safety and usefulness. Controlled simulations and a small-scale empirical experiment with open-source safety classifiers illustrate and validate the qualitative predictions of the theory.
As deep neural network (DNN) based natural language processing (NLP) models continue to grow in scale and complexity, the hardware systems supporting them are becoming increasingly intricate and sophisticated. This complexity leads to a higher likelihood of hardware errors that pose significant threats to the reliability and performance of NLP services. In this experimental study, we investigate the robustness of BERT models in the presence of hardware errors, which can corrupt model parameters stored in memory. Our study involves an extensive error injection campaign targeting four widely-used BERT models, evaluated across six benchmarks spanning three diverse application domains. Additionally, we demonstrate that applying parameter clipping techniques can significantly enhance the error tolerance of BERT models, achieving up to 100× improvement in robustness against hardware errors. Beyond error tolerance, we also explore the implications of these findings for energy-efficient hardware design, focusing specifically on SRAM. By combining SRAM voltage scaling techniques with the improved error tolerance of BERT models, we achieve average energy savings of up to 62.9 https://github.com/Raisony/Hugging-Error .
Industrial Control Systems (ICS) play a vital role in managing critical infrastructure like power grids and nuclear facilities. As ICS increase in complexity, the integration of Third-Party Components (TPCs) supporting advanced functionality into ICS firmware becomes inevitable. Unfortunately, this rapid expansion of the software supply chain introduces new attack surfaces in the ICS ecosystem. While products in the IT domain also regularly include TPCs, constraints specific to the ICS domain like stringent uptime requirements, force ICS vendors to incorporate TPCs with chaotic patching practices. In this paper, we present evidence that traditional TPC version-based vulnerability scanners fail to adequately characterize risks in modern ICS firmware due to non-standard integration practices, such as backporting official fixes and deploying custom patches. These unconventional integration methods, combined with the closed-source nature of hardened embedded systems, make accurate ICS supply chain vulnerability assessment exceedingly challenging. We address this issue by developing the first end-to-end framework, ICSBoM, to identify firmware vulnerabilities hidden in unconventionally imported TPCs. Our experiments using real-world ICS firmware show that ICSBoM achieves 100
Deep learning has become a cornerstone of modern machine learning. It relies heavily on vast datasets and significant computational resources for high performance. This data often contains sensitive information, making privacy a major concern in deep learning. Spiking Neural Networks (SNNs) have emerged as an energy-efficient alternative to conventional deep learning approaches. Nevertheless, SNNs still depend on large volumes of data, inheriting all the privacy challenges of deep learning. Homomorphic encryption addresses this challenge by allowing computations to be performed on encrypted data, ensuring data confidentiality throughout the entire deep learning pipeline. In this paper, we introduce PrivSpike, a privacy-preserving inference framework for SNNs using the CKKS homomorphic encryption scheme. PrivSpike supports deep SNNs and introduces two key algorithms for evaluating the Leaky Integrate-and-Fire activation function: (1) a polynomial approximation algorithm designed for high-performance SNN inference, and (2) a novel scheme-switching algorithm that optimizes precision at a higher computational cost. We evaluate PrivSpike on MNIST, CIFAR-10, Neuromorphic MNIST, and CIFAR-10 DVS using LeNet-5 and ResNet-19 architectures, achieving encrypted inference accuracies of 98.10
A fuzzy extractor is a cryptographic primitive that enables us to generate uniform randomness from fuzzy data w with high entropy and reproduce the same randomness from fuzzy data w' close to w. Conventional fuzzy extractors support only a single input, making them unsuitable for scenarios that require multi-factor authentication, distributed key management, or avoiding single points of failure. In this paper, we (re)formalize and construct k-out-of-n threshold fuzzy extractors which enable us to generate randomness from multiple fuzzy data (w_1, … , w_n) and recover the same string from k ≤ n fuzzy data (w'_i_1, … , w'_i_k) such that each of w'_i_j is close to w_i_j ( 1 ≤ j ≤ k ). We formalize the syntax and security notions of threshold fuzzy extractors as a natural extension of ordinary fuzzy extractors. For security, we consider information-theoretic security and computational reusability and robustness as in ordinary fuzzy extractors. Then, we propose two generic constructions of threshold fuzzy extractors. The first one satisfies information-theoretic security, and the second one satisfies reusability and robustness.
This paper studies the multi-user (mu) bound of Counter with CBC-MAC ( ), the authenticated encryption mode for block ciphers (BCs). Galois/Counter Mode ( ) is more advanced in the study of mu security, and Hoang et al. achieved the tight mu-security bound of σ _σ/2^n + up+ u^2/2^k , where k and n are respectively the key and block sizes, u is the number of users, p is the number of offline queries. Here, σ and σ _ are the crucial factors that represent the total number of BC invocations by all users and the maximum number of BC invocations per user, respectively. In contrast, while there are two known mu bounds for , uσ _^2/2^n + up+ u^2/2^k by Luykx et al. (Asiacrypt 2017) and σ ^2/2^n + up+ uσ/2^k by Zhang et al. (CCS 2024), both of which are not tight and worse than the bound for . Another line of research studies methods to enhance mu-security without disruptive changes, such as nonce randomization ( ) and nonce-based key derivation ( ) to improve offline and online security, respectively, but their applicability to has never been discussed. Filling these gaps, this paper first proves an improved mu-security bound of , which is tight, and reaches the ’s bound. We also prove that combined with and achieves the same bound as . With these results, is now proved to be as secure as . Furthermore, we propose a new enhancement method called nonce-based and tag-based key derivation ( ) and apply it to and . achieves a better bound beyond and , and the resulting schemes satisfy the needs of real-world applications that demand massive data.
Cyber deception has emerged as a promising paradigm for enhancing cybersecurity by introducing uncertainty and manipulating adversarial decision-making processes. However, research in this domain is hindered by the absence of flexible, reproducible, and measurable testbeds capable of supporting diverse deception strategies. Addressing this gap is essential to transforming cyber deception from a conceptual tool into an operational capability that can be reliably tested and deployed in various environments. This paper presents Cyber Deception Gym (CDGym), a configurable platform designed to address the disconnection between abstract deception strategies and their practical implementation. In order to enable scalable, modular, and automated deployment of deception strategies, we also introduce the Deception Configuration Schema (DCS), a structured approach to articulating configuration options and associated resource constraints of deception strategies. In addition, our platform supports comprehensive data collection and real-time feedback to facilitate effective evaluation. We prototype CDGym and evaluate it through case studies of three representative deception strategies, complemented by a large-scale penetration testing experiment with 80 professional testers and a usability study involving 15 deception researchers. The results demonstrate that CDGym facilitates reproducibility, scalability, and quantitative evaluation, thereby establishing itself as a robust platform for advancing cyber deception research.
Tosun and Savas (IEEE TIFS’23) proposed a non-profiling power analysis attack on masked ML-KEM, or CRYSTALS-Kyber. Their attack can recover a full secret key of Kyber with 7,000 power traces. Later, Tosun et al. (IEEE Access’24) claimed an improvement over the previous attack with only 550 traces, but the result is not convincing. In particular, their attack does not seem to recover a full secret key of masked Kyber; instead, it recovers only the absolute values for every coefficient of a secret key. Unfortunately, Tosun et al. did not provide convincing and efficient ways to recover the signs of every secret coefficient. In this paper, we show that 400 traces are sufficient to recover a full secret key of masked Kyber. This improvement is arguably significant, as the number of traces is only about 5
Subtree-based fork-choice rules such as GHOST can improve the throughput of Proof-of-Work (PoW) blockchains by crediting stale blocks, but they assume that honest miners have sufficiently similar views of the block tree. In heterogeneous networks, visibility asymmetry causes honest miners to compute different subtree weights, which can increase head oscillation, distort rewards, and create leverage for strategically timed releases. We propose Visibility-Aware GHOST (VA-GHOST), a drop-in fork-choice rule that estimates each block’s visibility from lightweight decentralized attestations carried in subsequent blocks, assigns a visibility factor ν _b∈ [0,1] , and computes subtree weight as a visibility-weighted subtree score. The empirical study is conducted on a node-local DAG implementation that realizes the protocol semantics of VA-GHOST, including local visibility counters, bounded certificates, and greedy visibility-weighted subtree selection. Across four scenarios, VA-GHOST substantially reduces reorganization frequency relative to LCR and standard GHOST. At the same time, it yields deeper average reorganizations, only modest fairness differences, and no consistent attacker-profitability improvement over standard GHOST under the evaluated withhold-and-release adversary. The resulting picture is mixed but technically informative: explicit visibility changes the stability profile of subtree-based PoW consensus in a systematic way, but the reported operating point produces a clear trade-off rather than a uniform gain across all metrics.
Emerging 6G communication systems impose unprecedented requirements on cryptographic primitives, demanding ultra-high throughput, low latency, and strong resistance to implementation-level attacks. LOL2.0 is a recently proposed stream cipher framework that achieves high software efficiency and strong security in post-quantum settings. While several stream ciphers have been proposed to address performance demands, side-channel-protected hardware implementations capable of sustaining 6G-class throughput remain largely unexplored. In this work, we present the first side-channel-protected hardware implementation that meets the 6G-class throughput demand. Focusing on the LOL2.0 stream cipher framework, we leverage Time Sharing Masking to achieve first-order security under the glitch-extended probing model. This design realizes full-phase protection covering initialization, keystream generation, and tag generation. To address diverse deployment requirements, we design two masked architectures: a compact variant optimized for area and randomness efficiency, and a fast variant targeting the maximum achievable throughput. The proposed fast implementations achieve peak throughputs of 183 Gbps and 142 Gbps for the unmasked and masked configurations, respectively. Meanwhile, the compact architecture reduces hardware cost by achieving areas as low as 23.25 kGE and 141.98 kGE in unmasked and masked designs, respectively, while still maintaining competitive throughput. Security is validated through practical side-channel evaluations using Test Vector Leakage Assessment on FPGA platforms. Across up to 100 million measured power traces, no statistically significant first-order leakage is observed for any protected configuration. Overall, this work realizes side-channel-protected stream cipher hardware that sustains ultra-high throughput, providing a concrete path toward secure cryptographic deployment in future 6G communication systems.
This paper presents a new framework for constructing efficient sum-check protocols for high-degree virtual multivariate polynomials. Existing approaches, such as HyperPlonk, suffer from an inherent bottleneck: polynomial multiplications inside the sum-check protocol lead to quasi-linear prover overhead in the polynomial degree d. To address this issue, we introduce doubly efficient sum-check (DESC) PIOP, which achieves linear prover time by integrating a generalized GKR protocol for general arithmetic circuits. The key insight is to reformulate virtual polynomial evaluation as a data-parallel circuit execution, thereby avoiding explicit polynomial multiplications. Building on the DESC framework, we derive two concrete applications. First, for customizable constraint systems (CCS), we reduce prover time complexity from O(qmd log ^2 d) to O(qmd) , where q denotes the number of constraint multisets, m the number of constraints, and d the maximum degree of any variable across all polynomials. Second, we propose SPARK PIOP, an improved polynomial IOP for sparse multilinear commitments, which reduces the total commitment size by nearly a quarter compared to the Lasso construction. Finally, as a conceptual consolidation, we emphasize that the efficiency of sum-check–based proof systems is fundamentally determined by how algebraic constraints are organized. By reorganizing circuit layers into low-degree polynomial relations, we reduce communication complexity while preserving the doubly efficient properties of GKR for both the prover and the verifier.
Rapid advances in Financial Technology (FinTech) have transformed the landscape of financial services, with Open Banking (OB) and its extension, Open Finance (OF), enabling safe data sharing to third parties, promoting competition and accessibility. In parallel, Decentralised Finance (DeFi) has emerged as a blockchain-based ecosystem for permissionless financial services, offering innovative services, but facing volatility and regulatory uncertainty. Despite the fundamental differences between OF and DeFi, recent developments indicate growing interest in bridging the two, as traditional institutions increasingly incorporate digital assets into their services. This paper introduces a cryptographic protocol that enables secure interaction between OF and DeFi in the setting of collateralised lending. Our protocol allows lenders to assess borrowers’ risk scores by evaluating a privacy-preserving function on their net worth, and to use blockchain assets as collateral, unlockable only through a proof of repayment or default in the form of OF authenticated data. We further propose a sub-protocol that directly integrates blockchain assets into risk estimation, ensuring both trustworthiness and privacy. Our protocol is based on a novel notion of fully homomorphic encryption (FHE) that provides stronger security guarantees against a potentially corrupted decryptor. We formalise our notion, Robust FHE and show how to instantiate it, starting from any standard FHE scheme. We also argue that existing notions of FHE fail to achieve our security notion. Finally, we prove the security of our OF protocol in the Universal Composable setting.
Dynamic access control is a central requirement in modern encrypted data storage, where decryption privileges must evolve as credentials and permissions change over time. In practice, such changes are routine: users join or leave projects, roles shift, devices are replaced or lost, keys expire or are rotated, and security incidents may necessitate immediate revocation or later restoration of access. Motivated by the need for dynamic access control in encrypted data storage, we explore how to implement puncturable encryption (PE) in environments where user credentials and permissions evolve over time. PE offers a powerful fine-grained revocation functionality. By “puncturing” a secret key, one can revoke decryption capability for specific ciphertexts, enabling fine-grained access control over who can get access to which data. This capability has driven strong theoretical and practical interest since the introduction of PE. However, the existing PE and its variants fall short in dynamic environments where revocation is not always permanent. Specifically, many deployments require the ability to restore access, or to lawfully delegate decryption rights for specific ciphertexts that were previously revoked. In this work, we bridge this gap by introducing a novel primitive Dynamic Puncturable Encryption (DPE). By “dynamicity”, we mean that the system simultaneously supports user-controlled revocation of decryption, trusted authority-controlled revocation or granting of access to data, and delegation of decryption rights based on requirements, all at a finer level. Such a feature further broadens the practical applicability of the PE paradigm and allows dynamic access control. We formalize the concept of DPE, and realize it through a lattice-based construction in the standard model that ensures quantum safety.
5G marks a major departure from previous cellular architectures, by transitioning from a monolithic design of the core network to a Service-Based Architecture (SBA) where services are modularized as Network Functions (NFs) communicating with each other via standard-defined HTTP-based APIs, called Service-Based Interfaces (SBIs). These NFs are deployed in private and public cloud infrastructures, and an OAuth-based access control framework restricts how they communicate with each other and obtain access to resources. Given the increased vulnerabilities of clouds to insiders, it is important to perform security testing of the 5G Core services to identify vulnerabilities that may allow attackers to use compromised NFs to obtain unauthorized access to resources. We present FivGeeFuzz, a grammar-based fuzzing framework, coupled with authorization testing modules, to uncover security flaws in 5G Core SBIs. FivGeeFuzz fuzzes token requests, performs positive and negative authorization testing, and automatically derives grammars from the 3GPP API specifications to generate malformed, unexpected, or semantically inconsistent inputs. We evaluate our approach on free5GC, the only open-source 5G core implementing Release 17-compliant SBIs with an access control mechanism. Using FivGeeFuzz, we discovered 134 invalid token requests accepted, and 14 previously unknown vulnerabilities in free5GC, leading to authorization privilege escalation, blocked benign authorization, runtime crashes, improper error handling, and other bugs. All bugs were disclosed to the free5GC team and patched.
DNS exfiltration remains a persistent threat vector, yet research suffers from critical gaps: lack of standardized tools and semantically invalid synthetic attacks. We present a modular framework for DNS exfiltration research that maintains RFC compliance, temporal realism, and behavioral coherence with real network traffic. Our framework comprises four components ensuring semantic validity: payload generation, victim selection from real network data, time-based attack injection, and query validation. We validate the framework’s modularity through three adversarial generators that each exercise a distinct component: a reinforcement-learning strategy selector, an LSTM benign-mimicry timing model, and Stegatetra. Stegatetra emerged from exploring what the encoding interface permits, evading all evaluated academic detectors by encoding data in query selection rather than query content. The framework also supports systematic defense evaluation by integrating existing state-of-the-art detectors alongside new ones such as ContraDNS, a contrastive learning detector we develop within the framework. Our evaluation reveals that no single detection paradigm catches all generator types, motivating multi-modal defense. We present this framework to enable reproducible DNS exfiltration research.
