LLM agents need to sustain goal-consistent reasoning across long multi-turn interactions under strict resource constraints. However, as the multi-turn context accumulates, it can destabilize the underlying LLM's internal representation of task-relevant information from earlier turns, blurring the boundary between constructive reasoning and representation drift. We formulate multi-turn reasoning as a hidden-state trajectory of the underlying LLM that is characterized via two complementary signals: temporal curvature that captures the directional consistency of turn-to-turn updates, and variance slope which measures the expansion or contraction of the exploration space. Across four tasks and three underlying LLMs, we observed that these geometric signals distinguish between correct and incorrect episodes prior to completion. We further decompose each episode into three-action chains formed from four actions (Read, Write, Respond, Transfer) and show that separability is action-dependent, with different signals distinguishing various chain patterns. Our experiments demonstrate that trajectory geometry can identify critical turns in the reasoning process, increasing task success rates on τ-Bench from 24.1

Model extraction attacks are an insidious threat against Deep Learning (DL) models, enabling adversaries to steal the architecture, parameters, and hyper-parameters. Existing literature observes varying attack success, but the underlying causes for model susceptibility remain unclear due to analysis difficulty. In this paper, we provide a comprehensive empirical study of state-of-the-art extraction attacks using SWIPE, an AI security assessment framework. Through large-scale experimentation across a plethora of DL models and attack scenarios, our work establishes a new fundamental understanding of extraction attacks, drawing parallels to API and low-level side-channel attacks, exploring transferability, extraction equivalency, and staging. Our findings: (1) elucidate key extraction characteristics showing strong resilience in particular configurations, (2) demonstrate that even partial extraction success enables further attack staging, (3) show equivalent stolen models, despite expressive power differences, exhibit similar captured knowledge, and (4) identify model compilers as a sufficient defense technique.

Large language models (LLMs) are increasingly deployed in domains requiring guardrails to detect unsafe, off-topic, or adversarial prompts. Existing guardrails predominately rely on fine-tuning to build classifiers, which often suffer from low generalization and high inference latency. We present kNNGuard, a training-free guardrail that utilizes the activation space of an off-the-shelf LLM. Given a small bank of 50 safe and unsafe prompts, kNNGuard extracts hidden activations and performs multi-layer kNN fusing activation-space and embedding-space scores for classification. Across six domains spanning topical and security prompts, kNNGuard achieves competitive or superior F1 compared to fine-tuned state-of-the-art guardrails while running 2.7x faster than the best comparable guardrail, and 10x faster than a fine-tuned safety classifier without gradient updates or fine-tuning. Domain adaptation requires only updating the labeled bank, which can be constructed in under 10 seconds and several orders of magnitude faster than established guardrails. We also analyze the impact of system prompts, layer selection, and integration into production LLM pipelines as a configurable, low-latency guardrail.

As modern artificial intelligence (AI) systems become more advanced and capable, they can leverage a wide range of tools and models to perform complex tasks. The task of orchestrating these models is increasingly performed by Large Language Models (LLMs) that rely on qualitative descriptions of models for decision-making. However, the descriptions provided to existing LLM-based orchestrators frequently do not reflect true model capabilities and performance characteristics, leading to suboptimal model selection, reduced task accuracy, and increased cost. In this paper, we conduct an empirical analysis of LLM-based orchestration limitations and propose a cost-aware model selection method that accounts for performance-cost trade-offs by incorporating quantitative model performance characteristics within decision-making. Initial experimental results demonstrate that our proposed method increases accuracy by 0.90

As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an LLM are an essential component of AI security. However, researchers conducting black-box adversarial emulation against production AI systems often struggle to determine whether a guardrail block or an LLM rejection has occurred. This distinction is important because the techniques used to bypass guardrails can differ substantially from those used to bypass LLM safety alignment, and has a material impact on attack technique selection and optimization. We propose the first black-box guardrail reconnaissance methodology, which detects the presence of a guardrail within a target AI system through behavioral monitoring of HTTP, lexical, and timing signals, assuming only black-box access and zero prior knowledge of the guardrail or AI system. Experiments demonstrate that our approach detects guardrail presence with 100

As Information and Communication Technology (ICT) use has become more prevalent, there has been a growing concern about how its associated greenhouse gas emissions will impact the climate. Estimating such ICT emissions is a difficult undertaking due to its complexity, its rapidly changing nature, and the lack of accurate and up-to-date data on individual stakeholder emissions. In this paper we provide a framework for estimating ICT’s carbon footprint and identify some of the issues that impede the task. We attempt to gain greater insight into the factors affecting the ICT sector by drawing on a number of interviews with industry experts. We conclude that more accurate emissions estimates will only be possible with a more more detailed, industry informed, understanding of the whole ICT landscape and much more transparent reporting of energy usage and emissions data by ICT stakeholders.

Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques. We demonstrate two approaches for bypassing LLM prompt injection and jailbreak detection systems via traditional character injection methods and algorithmic Adversarial Machine Learning (AML) evasion techniques. Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial utility achieving in some instances up to 100

Large Language Models (LLMs) have become widely used across various domains spanning search engines, code generation, and text creation. However, a major concern associated with their adoption is the high cost of inference, impacting both their sustainability and financial feasibility. In this study, we empirically study how different prompt and response characteristics directly impact LLM inference energy cost. We conduct experiments leveraging three open-source transformer-based LLMs across three task types$-$question answering, sentiment analysis, and text generation. For each inference, we analyzed prompt and response characteristics (length, semantic meaning, time taken, energy consumption). Our results demonstrate that even when presented with identical tasks, models generate responses with varying characteristics and subsequently exhibit distinct energy consumption patterns. We found that prompt length is less significant than the semantic meaning of the task itself. In addition, we identified specific keywords associated with higher or lower energy usage that vary between associated tasks. These findings highlight the importance of prompt design in optimizing inference efficiency. We conclude that the semantic meaning of prompts and certain task-related keywords significantly impact inference costs, leading the way for deeper exploration towards creating energy-adaptive LLMs.

The rapid growth of Internet of Vehicle (IoV) devices and Artificial Intelligence (AI) applications has accelerated the adoption of Cloud and Edge Computing. The advent of sixth-generation mobile communication technology (6G) further facilitates the deployment of Cloud-Edge collaborative computing in large-scale Intelligent Transportation Systems (ITS). Effective ITS must efficiently handle both latency-sensitive tasks (e.g., obstacle detection, traffic signal recognition) and computationally intensive tasks (e.g., path optimization, traffic flow prediction). However, existing Cloud-Edge collaborative frameworks struggle to accurately classify diverse workloads and provide efficient low-latency processing, leading to energy inefficiencies and task failures. To address these challenges, this paper introduces a Deep Learning-based Cloud-Edge Collaboration Framework (CECF) designed to optimize energy conservation in Cloud and Edge environments. CECF employs a DNN-based classifier to categorize workloads for processing in the Cloud or Edge. The classified tasks are managed by a dedicated Cloud scheduler (DSGA) and an Edge scheduler (EA-DFPSO), respectively. To enhance scheduling efficiency for highly variable Cloud tasks, DSGA incorporates a novel self-adaptive mutation algorithm and a random point fixed distance crossover method. Extensive evaluations using real-world workload traces demonstrate that CECF achieves up to a 8.5% improvement in system reliability and reduces energy consumption by 35.88% compared to baseline approaches.

Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques. We demonstrate two approaches for bypassing LLM prompt injection and jailbreak detection systems via traditional character injection methods and algorithmic Adversarial Machine Learning (AML) evasion techniques. Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial utility achieving in some instances up to 100% evasion success. Furthermore, we demonstrate that adversaries can enhance Attack Success Rates (ASR) against black-box targets by leveraging word importance ranking computed by offline white-box models. Our findings reveal vulnerabilities within current LLM protection mechanisms and highlight the need for more robust guardrail systems.

We propose horizontal intra-device scaling for network switches. Our approach allows for a network device to dynamically scale energy use in response to changing network utilization at a finer-grain in comparison to existing monolithic approaches, and enables a reduction in cost and environmental impact via reduced network energy use outside peak operating periods. We demonstrate the feasibility of intra-device switch scaling by designing a network switch architecture comprising multiple, less powerful, network devices leveraging a Multiple Spanning Tree Protocol (MSTP) to operate in parallel in place of a singular powerful device. Our preliminary results demonstrate that our approach can reduce total network energy use by 66.3% in comparison to established approaches with minimal performance penalty, and outlines future work for further improvement for this new form of network switch architecture for reducing energy use within core network infrastructure.

As Information and Communication Technology (ICT) use has become more prevalent, there has been a growing concern in how its associated greenhouse gas emissions will impact the climate. Estimating such ICT emissions is a difficult undertaking due to its complexity, its rapidly changing nature, and the lack of accurate and up-to-date data on individual stakeholder emissions. In this paper we provide a framework for estimating ICT's carbon footprint and identify some of the issues that impede the task. We attempt to gain greater insight into the factors affecting the ICT sector by drawing on a number of interviews with industry experts. We conclude that more accurate emissions estimates will only be possible with a more more detailed, industry informed, understanding of the whole ICT landscape and much more transparent reporting of energy usage and emissions data by ICT stakeholders.

Modern large-scale computing systems distribute jobs into multiple smaller tasks which execute in parallel to accelerate job completion rates and reduce energy consumption. However, a common performance problem in such systems is dealing with straggler tasks that are slow running instances that increase the overall response time. Such tasks can significantly impact the system's Quality of Service (QoS) and the Service Level Agreements (SLA). To combat this issue, there is a need for automatic straggler detection and mitigation mechanisms that execute jobs without violating the SLA. Prior work typically builds reactive models that focus first on detection and then mitigation of straggler tasks, which leads to delays. Other works use prediction based proactive mechanisms, but ignore heterogeneous host or volatile task characteristics. In this paper, we propose a Straggler Prediction and Mitigation Technique (START) that is able to predict which tasks might be stragglers and dynamically adapt scheduling to achieve lower response times. Our technique analyzes all tasks and hosts based on compute and network resource consumption using an Encoder Long-Short-Term-Memory (LSTM) network. The output of this network is then used to predict and mitigate expected straggler tasks. This reduces the SLA violation rate and execution time without compromising QoS. Specifically, we use the CloudSim toolkit to simulate START in a cloud environment and compare it with state-of-the-art techniques (IGRU-SD, SGC, Dolly, GRASS, NearestFit and Wrangler) in terms of QoS parameters such as energy consumption, execution time, resource contention, CPU utilization and SLA violation rate. Experiments show that START reduces execution time, resource contention, energy and SLA violations by 13%, 11%, 16% and 19%, respectively, compared to the state-of-the-art approaches.

Today's data centers use substantial amounts of the world's electrical supply. However, in line with circular economy concepts, much of this energy can be reused. Such reuse includes the heating of buildings, but also commodity dehydration, electricity production and energy storage. This multi-disciplinary paper presents several novel applications for data center waste heat. Next, the paper accounts for three case studies, taken from three different societal contexts: urban Malaysia, rural Costa Rica and semi-urban Sweden. A discussion on data center energy metrics leads to the development of a new metric, Datacenter Energy Sustainability Score (DESS), which is evaluated within the three use cases. Last, it is shown how a material social view on metrics provides a way past a problem that has haunted the data center industry for the last 15 years, whilst benefitting both data center owners who want to compete through sustainability as well as stakeholders from governments on local, regional and national levels. The paper makes clear that a sustainability strategy should be based on a material social view and stretch beyond the building itself. In fact, and as demonstrated by the relevance of DESS, modern data centers are so energy-efficient that data center sustainability is no longer mainly an engineering issue, but a matter requiring multi-disciplinary insights, approaches and collaboration.

The heterogeneity of Deep Learning models, libraries, and hardware poses an important challenge for improving model inference performance. Auto-tuners address this challenge via automatic tensor program optimization towards a target-device. However, auto-tuners incur a substantial time cost to complete given their design necessitates performing tensor program candidate measurements serially within an isolated target-device to minimize latency measurement inaccuracy. In this article we propose DOPpler, a parallel auto-tuning measurement infrastructure. DOPpler allows for considerable auto-tuning speedup over conventional approaches whilst maintaining high-quality tensor program optimization. DOPpler accelerates the auto-tuning process by proposing a parallel execution engine to efficiently execute candidate tensor programs in parallel across the CPU-host and GPU target-device, and overcomes measurement inaccuracy by introducing a high-precision on-device measurement technique when measuring tensor program kernel latency. DOPpler is designed to automatically calculate the optimal degree of parallelism to provision fast and accurate auto-tuning for different tensor programs, auto-tuners and target-devices. Experiment results show that DOPpler reduces total auto-tuning time by 50.5% on average whilst achieving optimization gains equivalent to conventional auto-tuning infrastructure.

Model Leeching is a novel extraction attack targeting Large Language Models (LLMs), capable of distilling task-specific knowledge from a target LLM into a reduced parameter model. We demonstrate the effectiveness of our attack by extracting task capability from ChatGPT-3.5-Turbo, achieving 73% Exact Match (EM) similarity, and SQuAD EM and F1 accuracy scores of 75% and 87%, respectively for only $50 in API cost. We further demonstrate the feasibility of adversarial attack transferability from an extracted model extracted via Model Leeching to perform ML attack staging against a target LLM, resulting in an 11% increase to attack success rate when applied to ChatGPT-3.5-Turbo.

Adversarial Machine Learning (AML) is a rapidly growing field of security research, with an often overlooked area being model attacks through side-channels. Previous works show such attacks to be serious threats, though little progress has been made on efficient remediation strategies that avoid costly model re-engineering. This work demonstrates a new defense against AML side-channel attacks using model compilation techniques, namely tensor optimization. We show relative model attack effectiveness decreases of up to 43% using tensor optimization, discuss the implications, and direction of future work.

Cloud providers attempt to maintain the highest levels of isolation between Virtual Machines (VMs) and inter-user processes to keep co-located VMs and processes separate. This logical isolation creates an internal virtual network to separate VMs co-residing within a shared physical network. However, as co-residing VMs share their underlying VMM (Virtual Machine Monitor), virtual network, and hardware are susceptible to cross VM attacks. It is possible for a malicious VM to potentially access or control other VMs through network connections, shared memory, other shared resources, or by gaining the privilege level of its non-root machine. This research presents a two novel zero-day cross-VM network channel attacks. In the first attack, a malicious VM can redirect the network traffic of target VMs to a specific destination by impersonating the Virtual Network Interface Controller (VNIC). The malicious VM can extract the decrypted information from target VMs by using open source decryption tools such as Aircrack. The second contribution of this research is a privilege escalation attack in a cross VM cloud environment with Xen hypervisor. An adversary having limited privileges rights may execute Return-Oriented Programming (ROP), establish a connection with the root domain by exploiting the network channel, and acquiring the tool stack (root domain) which it is not authorized to access directly. Countermeasures against this attacks are also presented

Cloud datacenters capable of provisioning high performance Machine Learning-as-a-Service (MLaaS) at reduced resource cost is achieved via auto-tuning: automated tensor program optimization of Deep Learning models to minimize inference latency within a hardware device. However given the extensive heterogeneity of Deep Learning models, libraries, and hardware devices, performing auto-tuning within Cloud datacenters incurs a significant time, compute resource, and energy cost of which state-of-the-art auto-tuning is not designed to mitigate. In this paper we propose Trimmer, a high performance and cost-efficient Deep Learning auto-tuning framework for Cloud datacenters. Trimmer maximizes DL model performance and tensor program cost-efficiency by preempting tensor program implementations exhibiting poor optimization improvement; and applying an ML-based filtering method to replace expensive low performing tensor programs to provide greater likelihood of selecting low latency tensor programs. Through an empirical study exploring the cost of DL model optimization techniques, our analysis indicates that 26–43% of total energy is expended on measuring tensor program implementations that do not positively contribute towards auto-tuning. Experiment results show that Trimmer achieves high auto-tuning cost-efficiency across different DL models, and reduces auto-tuning energy use by 21.8–40.9% for Cloud clusters whilst achieving DL model latency equivalent to state-of-the-art techniques.