Decentralized Learning offers a privacy-conscious alternative to centralized training, yet the direct exchange of model parameters between peers remains a significant vector for privacy leakage. We investigate the standalone privacy implications of model chunking, a technique previously only studied in combination with other defenses like node virtualization. We implement and compare static, cyclic, and random chunking strategies. To provide a robust evaluation, we also introduce an enhanced linkability attack using Hungarian matching and evaluate performance under limited adversary knowledge (10% dataset access). Experimental results on the MNIST and CIFAR-10 datasets show that while chunking can exacerbate membership inference risks by isolating local updates, it significantly improves resilience against linkability attacks. Specifically, we find that static and random chunking are most effective under full-epoch training conditions, whereas cyclic chunking offers minimal protection due to its similarity to full model exchange.
Speech synthesis models can generate highly realistic cloned voices by capturing the phonetic features of a speaker. However, adversaries may exploit this capability by collecting users’ speech samples (e.g., from social media platforms) without their consent to conduct voice cloning or deepfake attacks. While audio adversarial examples have been proposed as a defense mechanism, most of them rely on time-intensive optimization from scratch in the input space, rendering them impractical for latency-sensitive applications such as live audio streaming. They are also vulnerable to countermeasures such as denoising. To address these weaknesses, we propose SpeechShield, a universal and robust perturbation-generation framework that can work offline or in real time. SpeechShield injects adversarial perturbations into speech features that are critical to timbre, such as harmonic structure and energy spectral patterns. It prevents speech synthesis models from learning accurate voice representations and elevates resistance to adversarial removal. Moreover, SpeechShield projects input audio into a compact high-dimensional latent space to generate meta-perturbations, allowing for efficient fine-tuning adaptation to new samples with minimal delay. By incorporating perceptual objectives, SpeechShield also maintains the intelligibility and naturalness of protected speech. We have conducted extensive experiments on a range of advanced models, datasets, and real-world scenarios, showing that SpeechShield consistently outperforms state-of-the-art (SOTA) defenses in terms of protection effectiveness, transferability, and robustness, all at the lowest latency.
Point-wise reliability assessment helps determine how much confidence can be placed in individual predictions of machine learning models. Most existing studies focus on centralized learning (CL), where the full dataset is accessible for estimating reliability. In federated learning (FL), however, data remain distributed across clients and cannot be shared due to privacy constraints, making many traditional reliability estimators difficult to apply. This work adapts three representative reliability assessment paradigms to federated settings using data obfuscation approaches that avoid sharing raw data. The proposed variants: FedRel-GMM, FedRel-RHH, and FedRel-Emb are evaluated on real-world healthcare data. Experimental results show that FedRel-GMM and FedRel-RHH preserve the reliability trends observed in CL, while the embedding-based method fails to generalize due to shifts in the representation space across clients. These findings clarify which centralized techniques can be used in FL and provide a step toward building reliable distributed systems.
Large language model unlearning is typically evaluated in high-resource settings, while real-world deployments increasingly rely on memory-efficient pipelines such as 4-bit quantization and parameter-efficient fine-tuning (PEFT). This raises a key question: whether targeted unlearning remains reliable, secure, and privacy-preserving under such deployment constraints. This paper evaluates the dependability of targeted unlearning under a 4-bit quantized LLaMA-3 pipeline using TOFU and membership inference analysis across three random seeds.Three practical strategies are studied: Pure Gradient Ascent (PGA), retention-regularized Gradient Ascent (GAFT), and IDK-based supervised refusal tuning. The multi-seed results show that different unlearning strategies induce substantially different privacy-utility trade-offs. GAFT provides the most reliable balance across forgetting and privacy signals, while IDK achieves stronger direct suppression of memorized knowledge and the lowest MIA scores. However, a post hoc audit of 1,200 IDK forget-set generations shows that these gains are usually realized through hallucinated substitute answers rather than clean abstentions, and PGA exhibits comparatively unstable behavior under the same quantized setup.These findings suggest that unlearning effectiveness observed in idealized settings may not directly translate to dependable deployment scenarios, motivating system-level evaluation of unlearning in deployed ML systems.
AI agents increasingly delegate tasks to third-party extensions downloaded at runtime, known as skills. These skills can execute with the agent’s full credentials, filesystem, and network access. A single malicious skill can exfiltrate credentials and sensitive data with no mechanism to prevent it. We present NinjaShell, a skill-level privilege isolation system in which each skill declares its requirements in a declarative manifest. The runtime verifies those declarations against an agent policy, automatically derives a minimum-privilege sandbox, and enforces the policy at the kernel level regardless of skill behavior. The entire routing, derivation, and enforcement pipeline operates without human intervention, preserving full agent autonomy while defending against the principal attack vectors introduced by malicious skills.
Privacy protection and communication efficiency are two fundamental challenges in Federated Learning (FL). Differential Privacy (DP) and quantization-based compression have been widely adopted as the primary mechanisms to address these challenges, respectively. However, naively combining the two in FL is ineffective, as their interactions are nontrivial and may undermine both privacy guarantees and model utility. Consequently, DP-quantization methods have emerged, in which DP mechanisms are either coupled with or embedded into quantization. Despite their promise, this research area suffers from three critical gaps: the neglect of important practical considerations, the difficulty of fair comparison due to inconsistent evaluation setups, and the absence of in-depth analyses on how the interplay between DP and quantization generally affects the outcomes. These limitations collectively restrict the practicality of DP-quantization in FL.To address these gaps, we conduct a comprehensive reproduction and replication study of five representative DP-quantization mechanisms. We introduce the first unified taxonomy that systematizes existing design paradigms, and we re-implement all methods within a unified framework. Using 216 controlled experiments, we thoroughly examine the trade-offs among privacy protection, compression efficiency, and model utility. Our findings yield five key insights, demonstrating how specific factors, such as sensitivity shifts, entropy inflation, and noise injection timing, govern performance disparities across mechanisms. Guided by these insights, we further propose concrete recommendations to support principled future development in DP-quantization.
Cross-chain smart contract invocation enables interoperability among different blockchain service platforms. With the growing demand for cross-chain services, the performance of cross-chain smart contract invocations is becoming increasingly important. However, current cross-chain smart contract invocation technologies suffer from long latency and high abort rates. In this paper, we present ShuttleCross, an efficient cross-chain smart contract invocation framework, which ensures the atomicity and serializability of cross-chain transactions. ShuttleCross employs a hybrid concurrency control protocol to reduce the high abort rates caused by read-write conflicts of concurrent cross-chain transactions. Furthermore, ShuttleCross adopts a read-write separation strategy to accelerate cross-chain transaction execution by executing read-only function invocations off-chain. Our experimental results demonstrate that ShuttleCross significantly improves the performance of cross-chain transaction execution.
In the artifact publication phase of the open-source software supply chain, the disparity between rigorously reviewed upstream source code and loosely scrutinized released distributions creates a critical "Provenance Gap." This gap relies on the flawed assumption of transitive trust, a vulnerability exploited in attacks like the 2024 XZ Utils backdoor. While reproducible builds link source distributions to binaries, establishing a verifiable link from upstream VCS commits to source distributions remains an open challenge due to "Version-to-Commit Alignment" difficulties.We present VCAligner, a content-based alignment methodology that constructs inverted indexes over VCS histories to precisely map released artifacts to their originating commits, independent of fragile version tags. We evaluated VCAligner on a dataset of 2,984 verifiable PyPI packages derived from the 4,000 most-downloaded projects linked to public GitHub upstreams. Our results reveal a critical weakness in conventional tag-based heuristics: while they appear effective on 85% of the dataset, the residual 15% failure rate generates a catastrophic downstream audit workload of over 10.3 million commits. In contrast, VCAligner reduces this burden by two orders of magnitude (≈ 158×), bounding the total workload to under 65,000 commits. Furthermore, we provide the large-scale characterization of "Packaging Noise," classifying artifact divergence into structural additions (Path Phantoms) and content mutations (Blob Phantoms), thereby isolating the distinct attack surfaces of malicious injection and code tampering.
Cyber-physical systems (CPS) are a cornerstone of modern industry, combining Operational Technology (OT) with Information Technology (IT) to enhance the monitoring and control of systems. While this improves efficiency, it also exposes critical OT systems to new threats, as seen by incidents like Stuxnet and the attack on Ukraine’s energy grid. In both cases, attackers exploited vulnerabilities within the cyber layer to gain unauthorized access, allowing them to affect the physical operations and compromise the safety and dependability of the broader system. This highlights the growing need to better understand how failures might cascade across several dependability domains. Conventional security metrics, such as the Common Vulnerability Scoring System (CVSS) overlook aspects like operational context, limiting their relevance to CPS. While CVSS provides valuable insights into technical vulnerability severity, system operators must also evaluate operational risk across dependability dimensions, including availability, reliability, safety, integrity, and maintainability. This misalignment calls for a priority shift in CPS risk analysis, moving from data-driven approaches to consequence-driven models.By utilizing a Cyber Digital Twin (CDT), we can measure the impact of failures on operational risk. The CDT provides a high-fidelity replica of both the OT and IT domains within the CPS. In this environment, failures are generated and injected probabilistically, and their impact is analyzed across the dependability dimensions of the model. Through comprehensive sampling of failure scenarios, we develop quantifiable metrics that enable a consequence-driven risk assessment.This position paper advocates for a unified CPS risk assessment framework that prioritizes operational consequences and probabilistic failure modeling, which is achieved using high-fidelity cyber-physical digital twins. We explore the implications and future research directions of our method, highlighting its potential to identify critical dependability weaknesses and assist security analysts in prioritizing threats according to operational risk.
Adversarial Risk Analysis (ARA) provides a principled framework for modeling cybersecurity decisions under uncertainty, where the defender does not react to individual attacks but instead optimizes a security posture across the full threat landscape. However, existing ARA formulations for Network Intrusion Detection Systems (NIDS) rely on assumed parameter values, limiting their practical applicability. We present a methodology for grounding ARA-OSID (Adversarial Risk Analysis for Open Set Intrusion Detection) utility functions in empirical threat intelligence from MITRE ATT&CK v16. Building on an existing hybrid Long Short-Term Memory (LSTM) Markov attack chain prediction pipeline that generates over 8,000 tactic-ordered attack chains from 33 real-world campaigns, we extract attacker and defender utility parameters directly from ATT&CK technique metadata, group usage statistics, and D3FEND [1] defensive coverage mappings. Attacker effort, detection probability, resource cost, and benefit are derived from technique permissions, defensive countermeasure counts, kill-chain position, and National Cyber Incident Scoring System (NCISS) severity scores. Defender threat probability, false negative and false positive costs, model repair costs, and operation costs are computed from group frequency, severity weighted detection gaps, evasion sub technique counts, and mitigation portfolio size. The majority of parameters are derived directly from existing pipeline data structures, requiring no additional data collection, while a small number of configurable weights are explored through sensitivity analysis. The resulting empirically grounded utility functions are validated against NCISS campaign severity scores.
Sleep disorders affect about one billion people worldwide, yet automated sleep staging is limited by class imbalance in polysomnographic datasets and the representational capacity of classical generative models. This work compares a classical Generative Adversarial Network (GAN) with two Quantum Wasserstein GAN-GP (QWGAN-GP) variants—noiseless and noisy simulator—for synthetic EEG augmentation in sleep stage classification using the ANPHY-Sleep dataset [1]. Models are trained under a Wasserstein GAN with Gradient Penalty (WGAN-GP) across subsets of 2–4 statistical EEG features over 50 epochs. Results show consistent quantum-enhanced variance matching: QWGAN-GP variants achieve lower standard deviation mean absolute error (StdMAE) than the classical GAN, with reductions up to 70.9% at 3 features. The 6-qubit generator (26 = 64-dimensional Hilbert space) captures EEG variance more faithfully than a classical multilayer perceptron. Moderate Gaussian noise (σ = 0.1) during QGAN training acts as implicit regularisation, yielding the best StdMAE (0.064) and competitive classification (Accuracy = 0.880, F1 = 0.880). The classical GAN suffers mode collapse at higher dimensions, dropping to 0.535–0.585 accuracy, while the noiseless QGAN reaches 0.905 at 3 features. A downstream classification evaluation on real PSG labels confirms that the quantum generator preserves N1 minority-class F1 (up to 0.1053 at 4 features) where the classical GAN consistently collapses to N1 F1 = 0.000 across all feature configurations. These results demonstrate that hybrid quantum-classical generative models provide a structurally distinct and empirically superior approach for minority-class distribution learning in imbalanced clinical time-series, albeit with higher classical simulation overhead.
Large Language Models (LLMs) are increasingly adopted as code generation tools in professional and safety-critical contexts, yet the factors influencing the correctness and security of their output remain poorly understood. This lack of transparency poses a significant barrier to the deployment of LLMs in regulated environments. This paper presents a systematic, full-factorial study of three controllable factors in the LLM training pipeline (model size, training process, and training data quality) and quantifies their effect on Java code generation. By fine-tuning three BLOOM variants (560M, 1.1B, 3B) under two training regimes on both original and security-sanitized versions of the "The-Vault" dataset, we analyze 12 distinct configurations evaluated against CodeBLEU, Edit Distance Similarity, percentage of parsable code and percentage of secure code. Statistical analysis via ANOVA reveals that pre-training and model size are the dominant drivers, jointly explaining over 83% of variance in correctness metrics. Specifically, we identify a significant Size×Dataset interaction (accounting for 20.58% of secure code variance) which shows that security-aware data curation becomes increasingly impactful as model capacity grows, but only when combined with pre-training. These results suggest that security in AI-generated code is not merely a function of data volume, but an emergent property of model scale, initialization strategy, and their interaction with data curation.
Dependability in autonomous systems requires that safety-critical tasks complete before their deadlines and produce output of sufficient quality for the system to act on safely. These two requirements conflict when resources are scarce: a component that pursues full accuracy risks missing its deadline, while one that terminates early may produce output too degraded to be useful. Approximate computing addresses this tension by allowing a task to trade output quality for execution time; existing frameworks leave this trade-off unmanaged at the system level, with no mechanism to enforce quality floors or guarantee deadline satisfaction across a pipeline of components. We present PACT (Predictive Approximate Computing with Temporal guarantees), an OS-level framework that pairs a real-time EDF scheduler with a dedicated resource manager to make this trade-off explicit and enforceable. Each participating application registers a quality model, a quality target and a preapproved fallback with the resource manager. At runtime, the resource manager runs a predictive feasibility test; if a task cannot satisfy both its deadline and its quality target, the resource manager signals the application and directs the scheduler to substitute the fallback, so the system meets the deadline with output quality no worse than a known bound. We describe the design of PACT, a prototype implementation in progress using eBPF, and a planned evaluation on autonomous-stack workloads representative of drone and space applications.
Software Defined Networking (SDN) has revolutionized network management by decoupling the control and data planes, yet optimizing controller placement within hybrid networks remains a complex challenge affecting latency and reliability. This work investigates the foundatioanl CPP (Controller Placemnet Problem) optimization problem by benchmarking classical algorithms, specifically Greedy Optimization and K-Medoids, against quantum-inspired QAOA (Quantum Approximation Optmization Algorithm) models using real-world topologies from the Internet Topology Zoo, including AT&T North America and ERNET India. Through extensive simulations involving randomly distributed SDN and legacy nodes (Non-SDN), we evaluated each approach based on average end-to-end latency, computational efficiency, and selection stability. The findings reveal that while Greedy Optimization provides the most effective classical performance, quantum-inspired methods offer competitive solutions for limited candidate sets, paving the way for future hybrid classical–quantum network architectures.
The proliferation of Trusted Execution Environments (TEEs) across heterogeneous hardware architectures—ranging from x86 servers to ARM-based SoC—has created a fragmented security landscape.While TEEs offer strong guarantees of confidentiality and integrity, their vendor-specific implementations hinder cross-platform interoperability, complicate application development, and prevent advanced use cases.We propose FUTEE, a unified, formally verified framework designed to abstract TEE heterogeneity. FUTEE provides a hardware-agnostic interface for attestation, capability negotiation, and inter-enclave communication. By decoupling application logic from hardware-specific primitives, FUTEE enables seamless cooperation between diverse TEEs while maintaining a minimal Trusted Computing Base (TCB).
Thermal side-channel attacks are an increasingly relevant hardware security threat to modern computing systems. While gamification has proven effective for cybersecurity education, existing tools for side-channel analysis are either inaccessible to undergraduate students, limited to non-interactive formats such as board games and questionnaires, or designed for competitive play rather than structured learning. This paper presents a Unity-based educational game designed to teach thermal side-channel attack concepts through interactive visualization. The system comprises two game modes: one that teaches passive side-channel analysis on a simplified CPU pipeline by visualizing heat patterns across instruction execution phases, and another that introduces thermal analysis of memory access patterns through a heatmap-guided search for a hidden cryptographic key. Both modes feature progressive difficulty levels to support incremental learning. The game is deployed as a WebGL application for browser-based access and will be evaluated through a classroom survey consisting of Computer Science students. Preliminary design feedback and expected outcomes suggest that the game can make side-channel concepts more accessible to students across technical backgrounds.
Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model’s internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000× + larger guard models while cutting latency and compute costs.
Recently, the threat of cloud insiders is increasing as users handle sensitive information in virtual machines (VMs). To prevent cloud insiders from accessing sensitive information, clouds provide confidential VMs (CVMs), whose memory is protected. In RISC-V Confidential VM Extension (CoVE), a trusted software component guarantees correct address translation for CVMs. In contrast, AMD SEV-SNP delegates the management of the page tables to an untrusted hypervisor and verifies the correctness of address translation using an inverted page table. However, it is unclear whether this delegation architecture of SEV-SNP can be implemented in RISC-V without adding significant hardware components. This paper proposes software-defined SEV (SD-SEV), which realizes the delegation architecture for CVMs using a small, trusted software module and a minimal hardware extension. In SD-SEV, the SEV module securely maintains the inverted page table to guarantee the correctness of address translation. Upon memory access, it checks whether the results of address translation match the table using a hardware extension called a page success exception. We have implemented SD-SEV on QEMU and confirmed the detection of attacks against memory integrity and authenticity as well as the performance overhead.
Object detection is essential for real-time environmental recognition for autonomous driving systems. Recognition errors in autonomous driving can lead to catastrophic consequences. Therefore, a reliable architecture for making object detection systems tolerant to inference errors is necessary. This paper proposes AdROD, an adaptive redundancy technique for a real-time object detection system, aimed at reducing detection errors through redundancy while maintaining an affordable computational overhead. To reduce computational cost, AdROD dynamically adjusts the number of active detection models based on the uncertainty of detection results. By monitoring the confidence and agreement scores of detection results, AdROD includes additional models in the active set only when needed. We evaluate AdROD using a dataset collected from the CARLA autonomous driving simulator and demonstrate that the proposed method reduces computational costs by 77.8% compared to a static three-version redundant system, while maintaining comparable detection performance in terms of mAP and F1 score. AdROD effectively balances reliability and computational efficiency, making it a practical solution for real-time object detection in autonomous driving.
