USENIX Security '25
2025-08-13..2025-08-15
Seattle, United States
who it's for
security researchers, security engineers, product security managers, software supply chain engineers, platform engineers, security architects, incident responders
topics
adversarial red teaming for generative AI; automated red team orchestration frameworks; TLS trust agility and short-lived certificates; confidential computing for GPU clusters; hardening PKI and delegated credentials; securing package ecosystems (npm Homebrew PyPI Maven); training-data poisoning defenses and crawler mitigation; voting machine security and verifiability; accessibility failures in 2FA flows; legal risks of vulnerability disclosure and NDAs; digital product safety ingredient labels and telemetry
| title | author | length |
|---|---|---|
| The Power of Community: Insights and Opportunities | Darren Shou | 20m |
RSAC aggregates 45,000 registrants, ~3,000 speaker submissions and a 1,500-person program committee and runs an innovation sandbox and Shark Tank–style contest… | ||
| Please (Don't) Stop the Music: Adversarial Red-Teaming of AI... | Jannis Kirschner | 14m |
Red teams two music-generation services with a corpus of 275 banned German songs, finds roughly 70–75% bypass of default filters producing about ten hours of… | ||
| AI Red Teaming and Automation: Exploring Societal Risks in... | Bolor-Erdene Jagdagdorj | 20m |
Shows that simple tactics reliably bypass safety: a direct English request for drug synthesis is blocked but an equivalent Mongolian language bypass returns… | ||
| Trust Agility in an Era of Transient Ties: Rethinking TLS... | Hoss Shafagh | 20m |
Concrete roadmap: root programs cap roots to 10-year root limit and server certificates shrink to 47-day server certs by 2029, forcing automation and… | ||
| Trusted Hardware for AI Workloads: Extending Confidential... | Shannon Egan | 20m |
Argues that confidential computing on CPUs already works but scaling to multi‑GPU AI clusters remains the bottleneck: single‑GPU solutions exist (closed‑source… | ||
| Securing Meta's Production PKI Credentials | Ross Smith IV | 25m |
Meta protects billions of PKI credentials (some valid up to 3 months) against root-level exfiltration by combining IP binding checks, short-lived tokens, and… | ||
| Security Theater Is Canceled: Time for a Real Show | Lea Kissner | 20m |
Covers concrete incidents and concrete failures: social engineering by Scattered Spider social engineering and teenagers, nation-state campaigns (SolarWinds… | ||
| Risk Is Not a Hammer, and Most Hazards Aren't Nails | Adam Shostack | 21m |
Claim: quantifying cyber risk usually fails to guide decisions because necessary iteration and causal links are missing. Evidence: a production auto run fix… | ||
| Everything Old Is New Again: Legal Restrictions on... | Kendra Albert | 25m |
Argues that many public bug-bounty and VDP platforms contractually force non-disclosure clauses that bar researchers from sharing findings, citing live… | ||
| Digital Product Safety: Rejecting Software as Magic | Lisa LeVasseur | 17m |
Argues that software is not magic but a product class defined by being software-driven, internet connected, and human-interactive, and that digital product… | ||
| Fighting Fire with Venom: Adversarial Defense Against... | Nick Sullivan | 23m |
Venom is an inline reverse proxy (implemented on Cloudflare Workers) that fingerprints requests—headers, TLS fingerprints, IP clusters, request cadence—and… | ||
| Inside Out: Security Designed With, Not For | Kausalya Ganesh | 23m |
A Cisco accessibility research program uses Wizard of Oz testing plus usability sessions with screen readers, voice control, and screen magnification to test… | ||
| Building a Voting Machine Everyone Can Trust | Ben Adida | 22m |
VotingWorks builds an open-source voting machine and argues trust depends on resilience to human error more than just security. Examples: folded mail ballots… | ||
| Securing Packages in npm, Homebrew, PyPI, Maven Central, and... | Zach Steindler | 19m |
Package registries move from brittle GPG signatures to Sigstore attestations that embed nonfalsifiable links to source commit, build instructions, and build… | ||
| Zombie Devices Are Running Amuck! | Stacey Higginbotham | 21m |
Consumer Reports shows concrete numbers: a nationally representative December survey finds 43% of buyers didn’t know devices could lose software support, and… | ||
| Usernames, Passwords, and Security | Rik Farrow | 20m |
Claim: usernames serve two distinct roles—UID/SID mapping for OS security (Unix small integer UIDs, Windows SIDs and access tokens) and account identifiers for… | ||
| Abusability of Automation Apps in Intimate Partner Violence | Shirley Zhang, Paul Chung, Jacob Vervelde, Nishant Korapati, Rahul Chatterjee, Kassem Fawaz | 15m |
Paper analyzes iOS Shortcuts, Samsung Modes & Routines, Tasker, and IFTTT and shows automation apps can enable four concrete IPV attacks: surveillance… | ||
| Malicious LLM-Based Conversational AI Makes Users Reveal Personal Information | Xiao Zhan, Juan Carlos Carrillo, William Seymour, José Such | 13m |
Twelve LLM-based CAIs are deployed (three models × four prompt strategies) and tested with a randomized trial of 502 participants via a Gradio interface… | ||
| An Industry Interview Study of Software Signing for Supply Chain Security | Kelechi G. Kalu, Tanmay Singla, Chinenye Okafor, Santiago Torres-Arias, James C. Davis | 19m |
Eighteen semi‑structured interviews across 13 organizations produce a refined software factory model that maps where signatures are created versus where they… | ||
| A First Look at Governments' Enterprise Security Guidance | Kimberly Ruth, Raymond Buernor Obu, Ifeoluwa Shode, Gavin Li, Carrie Gates, Grant Ho, Zakir Durumeric | 15m |
A systematic corpus of guidance from 41 countries is curated and represented with a tree-based taxonomy and a quantitative comparison metric, then ten… | ||
| EmbedX: Embedding-Based Cross-Trigger Backdoor Attack Against Large Language | Nan Yan, Yuqing Li, Xiong Wang, Jing Chen, Kun He, Bo Li | 16m |
Introduces an embedding-space soft trigger that maps many tokens to one optimized continuous vector, injects it by freezing model weights and fine-tuning only… | ||
| My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP | Yufan You, Jianjun Chen, Qi Wang, Haixin Duan | 12m |
Built a differential fuzzer called ZipDiff differential fuzzer and fuzzed 50 ZIP parsers across 19 languages, finding that out of 1,225 parser pairs only four… | ||
| X.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in | Bing Shi, Wenchao Li, Yuchen Wang, Xiaolong Bai, Luyi Xing | 13m |
An automated tool generates and mutates crafted X.509 certificates to fuzz parsing and validation code, discovering 18 new vulnerabilities and confirming 12… | ||
| AutoLabel: Automated Fine-Grained Log Labeling for Cyber Attack Dataset | Yihao Peng, Tongxin Zhang, Jieshao Lai, Yuxuan Zhang, Yiming Wu, Hai Wan, Xibin Zhao | 08m |
AutoLabel turns log labeling into extracting an attack subgraph from a provenance graph, using instrumentation to emit auxiliary alignment info, inject attack… | ||
| RollingEvidence: Autoregressive Video Evidence via Rolling Shutter Effect | Feng Qian, Lingfeng Zhang, Tao Luo, Shiqi Xu, Zhijun Yu, Wei Wang | 10m |
An active system embeds rolling shutter stripes by modulating an LED with a 16‑FSK LED probe and records them on commodity CMOS phones; an autoregressive… | ||
| From Constraints to Cracks: Constraint Semantic Inconsistencies as | Jiaxu Zhao, Yuekang Li, Yanyan Zou, Yang Xiao, Naijia Jiang, Yeting Li, Nanyu Zhong, Bingwei Peng, Kunpeng Jian, Wei Huo | 13m |
Empirical study finds over 86% of embedded-system vulnerabilities trace to mismatched input constraints across front end, back-end explicit, and back-end… | ||
| Ares: Comprehensive Path Hijacking Detection via Routing Tree | Yinxiang Tao, Chengwan Zhang, Changqing An, Shuying Zhuang, Jilong Wang, Congcong Miao | 16m |
Ares detects path hijacking by flagging newly observed prefix routing trees and comparing them to historical trees using a weighted edit distance that gives… | ||
| Catch-22: Uncovering Compromised Hosts using SSH Public Keys | Cristian Munteanu, Georgios Smaragdakis, Anja Feldmann, Tobias Fiebig | 12m |
A scalable method probes SSH servers by sending public key auth requests and treating a server challenge as proof the key exists locally, using a patched ZMap… | ||
| Self-interpreting Adversarial Images | Tingwei Zhang, Collin Zhang, John X. Morris, Eugene Bagdasarian, Vitaly Shmatikov | 10m |
Shows a new attack that embeds imperceptible perturbations into images that act as image soft prompts and steer multimodal LLM outputs to adversary objectives… | ||
| TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices | Yumingzhi Pan, Zhen Ling, Yue Zhang, Hongze Wang, Guangchi Liu, Junzhou Luo, Xinwen Fu | 13m |
Claim: attackers use Tor to anonymously exploit cloudless IoT devices. Built TORCHLIGHT—three low-cost VPS exit nodes, kernel IP-set filtering, and an… | ||
| CloudFlow: Identifying Security-sensitive Data Flows in Serverless | Giuseppe Raffa, Jorge Blasco, Dan O'Keeffe, Santanu Kumar Dash | 14m |
CloudFlow statically finds security-sensitive data flows in Python serverless apps by extracting infrastructure definitions (events, permissions, handlers)… | ||
| Serverless Functions Made Confidential and Efficient with Split Containers | Jiacheng Shi, Jinyu Gu, Yubin Xia, Haibo Chen | 17m |
CoFunc implements a split container architecture that runs multiple confidential serverless functions inside one CVM by pairing each confidential instance with… | ||
| Surviving in Dark Forest: Towards Evading the Attacks from Front-Running Bots | Zuchao Ma, Muhui Jiang, Feng Luo, Xiapu Luo, Yajin (Andy) Zhou | 21m |
EVScope uses dynamic binary analysis plus machine learning to scan 6,761,186 arbitrage transactions and 71 real attack transactions and identifies 32 concrete… | ||
| SoK: Inaccessible & Insecure: An Exposition of Authentication Challenges Faced | Md Mojibur Rahman, Redoy Akanda, Amanda Lacy, Nitesh Saxena | 15m |
Authors develop the ALESA framework and apply 5 accessibility and 8 security metrics to 50 papers, evaluating 37 general-purpose and 13 dedicated schemes. The… | ||
| AirTag-Facilitated Stalking Protection: Evaluating Unwanted Tracking | Dañiel Gerhardt, Matthias Fassl, Carolyn Guthoff, Adrian Dabrowski, Katharina Krombholz | 11m |
Two field studies test AirTag anti‑stalking features with NA=50 participants for notification reliability and NB=19 in a deception plus locating task. Results… | ||
| Shadowed Realities: An Investigation of UI Attacks in WebXR | Chandrika Mukherjee, Reham Mohamed, Arjun Arunasalam, Habiba Farrukh, Z. Berkay Celik | 16m |
WebXR exposes 14 security‑sensitive UI properties and the authors implement five novel UI attacks (visual overlapping, sequential rendering, malvertising, GUI… | ||
| I Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large | Zibo Gao, Junjie Hu, Feng Guo, Yixin Zhang, Yinglong Han, Siyuan Liu, Haiyang Li, Zhiqiang Lv | 15m |
Shows a practical local attack that recovers LLM inputs and outputs by observing CPU cache behavior: embedding lookups leak token values via unique cache-line… | ||
| Enabling Low-Cost Secure Computing on Untrusted In-Memory Architectures | Sahar Ghoflsaz Ghinani, Jingyao Zhang, Elaheh Sadredini | 20m |
Uses arithmetic secret sharing and Yao's garbled circuits to split work between CPU TE and UPMEM PIM, with TE precomputation to avoid CPU bottlenecks… | ||
| Dumbo-MPC: Efficient Fully Asynchronous MPC with Optimal Resilience | Yuan Su, Yuan Lu, Jiliang Li, Yuyi Wang, Chengyi Dong, Qiang Tang | 10m |
Dumbo-MPC claims fully asynchronous MPC with all-phase G.O.D. and optimal resilience t < n/3 by combining a fast optimistic path with a fully asynchronous… | ||
| FABLE: Batched Evaluation on Confidential Lookup Tables in 2PC | Zhengyuan Su, Qi Pang, Simon Beyzerov, Wenting Zheng | 15m |
FABLE is a concrete system that implements confidential lookup table evaluation by combining batch PIR, symmetric encryption, and batching to get sublinear… | ||
| SoK: Understanding zk-SNARKs: The Gap Between Research and Practice | Junkai Liang, Daqi Hu, Pengfei Wu, Yunbo Yang, Qingni Shen, Zhonghai Wu | 18m |
Provides a concrete master recipe that converts a program into a zk-SNARK and classifies 40+ zk-SNARK schemes by their core techniques (QAP, PCP/PCS… | ||
| Context Matters: Qualitative Insights into Developers' Approaches and... | Elizabeth Lin, Sparsha Gowda, William Enck, Dominik Wermke | 16m |
Study interviews 20 engineers and reports 20 interviews that reveal SCA tools are usually wired into CI/CD but produce floods of generic alerts that lack… | ||
| SelfDefend: LLMs Can Defend Themselves against Jailbreaking in... | Xunguang Wang, Daoyuan Wu, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Shuai Wang, Yingjiu Li, Yang Liu, Ning Liu, Juergen Rahmel | 12m |
SelfDefend implements a shadow LLM that runs in parallel to a target model to detect harmful intent, using two detection templates (direct and intent prompts)… | ||
| SoK: So, You Think You Know All About Secure Randomized Caches? | Anubhav Bhatla, Hari Rohit Bhavsar, Sayandeep Saha, Biswabandan Panda | 14m |
Systematic evaluation isolates five concrete knobs—skewing, extra invalid tags, high associativity, replacement policy, and remapping—and measures eviction… | ||
| Systematic Evaluation of Randomized Cache Designs against Cache Occupancy | Anirban Chakraborty, Nimish Mishra, Sayandeep Saha, Sarani Bhattacharya, Debdeep Mukhopadhyay | 15m |
Compares five designs—CEASER, CEASER-S, MIRAGE, ScatterCache, SassCache—using a uniform benchmarking strategy across multiple replacement policies and shows… | ||
| Exploiting Inaccurate Branch History in Side-Channel Attacks | Yuhui Zhu, Alessandro Biondi | 13m |
Paper shows three new primitives — Spectre-BSE, Spectre-BHS and BiasScope — that exploit undocumented BPU behaviors (bias‑free branch prediction, branch status… | ||
| Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection | Matej Bölcskei, Flavien Solt, Katharina Ceesay-Seitz, Kaveh Razavi | 11m |
Encarsia automatically injects realistic RTL bugs by rerouting wires and mutating multiplexor select logic in an intermediate representation, then formally… | ||
| Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by... | Sandro Rüegge, Johannes Wikner, Kaveh Razavi | 14m |
Finds asynchronous branch predictor updates that create Branch Predictor Race Conditions allowing predictions to be inserted with the wrong privilege tag on… | ||
| GraphAce: Secure Two-Party Graph Analysis Achieving Communication Efficiency | Jiping Yu, Kun Chen, Yunyi Chen, Xiaoyu Fan, Xiaowei Zhu, Cheng Hong, Wenguang Chen | 18m |
Claims a secure two-party graph analysis framework that removes any network traffic tied to edges and achieves Theta(|V|) communication per iteration while… | ||
| Breaking the Layer Barrier: Remodeling Private Transformer Inference with... | Tianshi Xu, Wen-jie Lu, Jiangrui Yu, Yi Chen, Chenqi Lin, Runsheng Wang, Meng Li | 15m |
BLB restructures Transformer inference by decomposing layers into operators, fusing adjacent linear operators under CKKS to avoid frequent HE↔MPC conversions… | ||
| General-Purpose f-DP Estimation and Auditing in a Black-Box Setting | Önder Askin, Holger Dette, Martin Dunsche, Tim Kutta, Yun Lu, Yu Wei, Vassilis Zikas | 19m |
Black-box procedure estimates the f-DP trade-off curve by sampling outputs from neighboring databases, fitting densities with a kernel density estimator, and… | ||
| Stack Overflow Meets Replication: Security Research Amid Evolving... | Alfusainey Jallow, Sven Bugiel | 18m |
Replication of six prior Stack Overflow studies finds that four produce significantly different conclusions when rerun on a 2022 dump, so Stack Overflow… | ||
| Confusing Value with Enumeration: Studying the Use of CVEs in Academia | Moritz Schloegel, Daniel Klischies, Simon Koch, David Klein, Lukas Gerlach, Malte Wessels, Leon Trampert, Martin Johns, Mathy Vanhoef, Michael Schwarz, Thorsten Holz, Jo Van Bulck | 19m |
Analysis of 1,803 CVEs claimed in 304 papers finds 34% unconfirmed or disputed, 274 reserved, 288 with no maintainer response, and 52 where maintainers say… | ||
| "That's my perspective from 30 years of doing this": An Interview Study on... | Alexander Krause, Harjot Kaur, Jan H. Klemmer, Oliver Wiese, Sascha Fahl | 14m |
Interview study of 21 experienced developers finds cryptographic updates follow a six‑phase process and reveal 13 distinct challenges, with backward… | ||
| DP-BREM: Differentially-Private and Byzantine-Robust Federated Learning... | Xiaolan Gu, Ming Li, Li Xiong | 16m |
Cross-silo federated learning uses client momentum that averages each client’s updates over rounds so tiny malicious perturbations accumulate and become… | ||
| Demystifying the (In)Security of QR Code-based Login in Real-world Deployments | Xin Zhang, Xiaohan Zhang, Bo Zhao, Yuhong Nan, Zhichen Liu, Jianzhou Chen, Huijun Zhou, Min Yang | 13m |
Presents a systematic measurement showing QR code logins across 350 sites, 109 testable, and 43% vulnerable; generalizes the QRLogin workflow, exposes six… | ||
| Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in... | Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau, Julien Lecomte | 23m |
Finds two concrete platform-wide exploits: COAT (Cross-app OAuth Account Takeover) and CORF (Cross-app Request Forgery), plus a semi-automated tester COVScan… | ||
| Predictive Response Optimization: Using Reinforcement Learning to... | Garrett Wilson, Geoffrey Goh, Yan Jiang, Ajay Gupta, Jiaxuan Wang, David Freeman, Francesco Dinuzzo | 12m |
A system called Predictive Response Optimization combines reinforcement learning with model predictive control to pick enforcement actions per account using… | ||
| TapTrap: Animation-Driven Tapjacking on Android | Philipp Beer, Marco Squarcina, Sebastian Roth, Martina Lindorfer | 15m |
TapTrap is an animation-driven tapjacking that lets zero-permission apps supply custom entry animations to make a launched victim activity transparent or… | ||
| BulletCT: Towards More Scalable Ring Confidential Transactions With... | Nan Wang, Qianhui Wang, Dongxi Liu, Muhammed F. Esgin, Alsharif Abuadbba | 09m |
Provides a concrete critique of Any-out-of-N DLOG proofs (the ZGSX23 construction), showing they force N tags (not K) so transaction sizes balloon, and that… | ||
| Your Shield is My Sword: A Persistent Denial-of-Service Attack via the... | Shuhan Zhang, Shuai Wang, Li Chen, Dan Li, Baojun Liu | 12m |
Describes RUC, an attack that injects unvalidated DNSSEC troubleshooting responses (via CD bit queries) into resolver caches and causes persistent validation… | ||
| POPS: From History to Mitigation of DNS Cache Poisoning Attacks | Yehuda Afek, Harel Berger, Anat Bremler-Barr | 17m |
POPS is an IPS module that combines three simple rules for detection with a mitigation that flips the DNS TC flag to force TCP; the mitigation claims zero… | ||
| DNS FLaRE: A Flush-Reload Attack on DNS Forwarders | Gilad Moav, Yehuda Afek, Anat Bremler-Barr, Amit Klein | 16m |
Claims a practical cache timing side channel that infers when specific sites or IoT events occur by flushing and reloading home DNS forwarder caches. Attack… | ||
| Assessing the Aftermath: the Effects of a Global Takedown against... | Anh V. Vu, Ben Collier, Daniel R. Thomas, John Kristoff, Richard Clayton, Alice Hutchings | 14m |
Analysis uses web traffic, chat crawls, and attack logs from Hopscotch, Ampot, NESCO and industry self-reports to quantify a multinational action that seizes… | ||
| BGP Vortex: Update Message Floods Can Create Internet Instabilities | Felix Stöger, Henry Birge-Lee, Giacomo Giuliari, Jordi Subira-Nieto, Adrian Perrig | 22m |
Shows a concrete exploit where three BGP UPDATE messages using standard BGP Communities (a local-preference-lowering and a do-not-forward tag) forces three… | ||
| Onions Got Puzzled: On the Challenges of Mitigating Denial-of-Service... | Jinseo Lee, Hobin Kim, Min Suk Kang | 12m |
Researchers demonstrate OnionFlation, a family of attacks that sends a few hundred low-volume requests at the end of each 5‑minute measurement window (an… | ||
| TimeTravel: Real-time Timing Drift Attack on System Time Using Acoustic Waves | Jianshuo Liu, Hong Li, Haining Wang, Mengjie Sun, Hui Wen, Jinfa Wang, Limin Sun | 16m |
Shows a practical attack that uses a ceramic transducer to launch guided acoustic waves through solids to a 32.768 kHz RTC crystal, injecting phase bursts… | ||
| HubBub: Contention-Based Side-Channel Attacks on USB Hubs | Junpeng Wan, Yanxiang Bi, Han Gao, Dave (Jing) Tian | 08m |
USB hub contention leaks high-resolution timing: attackers saturate hub with 4KB SSD I/Os to force congestion, probe I/O intervals via a host process, VM… | ||
| Lost in Translation: Enabling Confused Deputy Attacks on EDA Software... | Flavien Solt, Kaveh Razavi | 16m |
Claims a practical attack chain: a new fuzzer TRANSFUZZ differentially fuzzes RTL across multiple simulators and synthesizers to find translation bugs… | ||
| Thunderdome: Timelock-Free Rationally-Secure Virtual Channels | Zeta Avarikioti, Yuheng Wang, Yuyi Wang | 15m |
Proposes a timelock-free payment channels construction that builds virtual channels on top of two underlying channels and a committee of bonded wardens… | ||
| Ariadne: Navigating through the Labyrinth of Data-Driven Customization... | Parjanya Vyas, Haseeb Ur Rehman Faheem, Yousra Aafer, N Asokan | 23m |
Ariadne performs static analysis on decompiled ROMs to build an AC dependency graph that models framework data holders and their relations, propagates… | ||
| Harness: Transparent and Lightweight Protection of Vehicle Control on... | Haochen Gong, Siyu Hong, Shenyi Yang, Rui Chang, Wenbo Shen, Ziqi Yuan, Chenyang Yu, Yajin (Andy) Zhou | 17m |
Harness isolates a minimal vehicle-control domain using hardware virtualization (ARM stage‑2 paging) and a hypervisor module called the low visor to run car… | ||
| Scoop: Mitigation of Recapture Attacks on Provenance-Based... | Yuxin (Myles) Liu, Habiba Farrukh, Ardalan Amiri Sani, Sharad Agarwal, Gene Tsudik | 17m |
Provenance stamps alone are vulnerable to recapture attacks that display fakes on screens or printouts and then rephotograph them; Scoop detects these by… | ||
| Tracking You from a Thousand Miles Away! Turning a Bluetooth Device into... | Junming Chen, Xiaoyue Ma, Lannan Luo, Qiang Zeng | 16m |
A new method called nRootTag converts unprivileged Linux/Windows/Android machines into trackable AirTags by abusing Find My’s acceptance of public-address BLE… | ||
| SoK: Automated TTP Extraction from CTI Reports – Are We There Yet? | Marvin Büchel, Tommaso Paladini, Stefano Longari, Michele Carminati, Stefano Zanero, Hodaya Binyamini, Gal Engelberg, Dan Klein, Giancarlo Guizzardi, Marco Caselli, Andrea Continella, Maarten van Steen, Andreas Peter, Thijs van Ede | 16m |
The paper systematizes 40 prior methods, reimplements 16 core NLP pipelines, and runs over 100 experiments mapping sentences to MITRE ATT&CK IDs using two… | ||
| SoK: Efficiency Robustness of Dynamic Deep Learning Systems | Ravishka Rathnasuriya, Tingxi Li, Zexin Xu, Zihe Song, Mirazul Haque, Simin Chen, Wei Yang | 21m |
Paper defines a taxonomy of efficiency attacks on adaptive models across D1: skipping mechanisms, D2: dynamic inference iterations, and D3: variable output… | ||
| "Please don't send that bot anything": A Mixed-methods Study of Personal... | Hoang Dai Nguyen, Sumit Dhungana, Madhulika Itha, Phani Vadrevu | 10m |
Mixed-methods measurement of PROSPER shows attackers monitor payment-related posts and impersonate ordinary users to reroute funds, tracking 181 PROSPER… | ||
| 'Hey mum, I dropped my phone down the toilet': Investigating Hi Mum... | Sharad Agarwal, Emma Harvey, Enrico Mariconti, Guillermo Suarez-Tangil, Marie Vasek | 16m |
Collaboration with a UK mobile operator yields 342 initial scam texts and 711 engaged conversations where scammers ask for money; interaction with scammers and… | ||
| Secure Caches for Compartmentalized Software | Kerem Arıkan, Huaxin Tang, Williams Zhang Cen, Yu David Liu, Nael Abu-Ghazaleh, Dmitry Ponomarev | 14m |
Framework SEC (aka SCC) isolates caches by domain-oriented partitioning, adds an active domain register (ADR) to keep L1 hits at baseline, and creates… | ||
| A Formal Analysis of Apple's iMessage PQ3 Protocol | Felix Linker, Ralf Sasse, David Basin | 16m |
Formal verification of Apple's iMessage PQ3 models its hybrid ECC+KEM ratchet, proves post-quantum, post-compromise security plus secrecy, forward secrecy… | ||
| OwlC: Compiling Security Protocols to Verified, Secure... | Pratap Singh, Joshua Gancher, Bryan Parno | 13m |
OwlC compiles Owl protocol specifications into side‑channel‑resistant Rust libraries and mechanically verifies their fidelity to an itrees specification using… | ||
| Vulnerability of Text-Matching in ML/AI Conference Reviewer Assignments... | Jhih-Yi (Janet) Hsieh, Aditi Raghunathan, Nihar B. Shah | 15m |
Automated text-matching used for reviewer assignment is exploitable: combining adversarial archive curation (keeping only the most similar past paper) with… | ||
| LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband... | Tuan Dinh Hoang, Taekkyung Oh, CheolJun Park, Insu Yun, Yongdae Kim | 14m |
LLFuzz is an over-the-air dynamic tester that targets PDCP, RLC, MAC and PHY lower layers by generating 3GPP-spec-compliant test cases and actively toggling… | ||
| Gotta Detect 'Em All: Fake Base Station and Multi-Step Attack Detection... | Kazi Samin Mubasshir, Imtiaz Karim, Elisa Bertino | 11m |
FBSDetector identifies fake base stations and 21 multi-step attacks from layer‑3 traces using stateful LSTM with attention, packet‑level then trace‑level… | ||
| SNI5GECT: A Practical Approach to Inject aNRchy into 5G NR | Shijie Luo, Matheus E. Garbelini, Sudipta Chattopadhyay, Jianying Zhou | 13m |
SNI5GECT passively sniffs pre-auth 5G NR messages, tracks protocol state, and injects downlink payloads to UEs without a rogue gNB, implemented against five… | ||
| eSIMplicity or eSIMplification? Privacy and Security Risks in the eSIM... | Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas, Aanjhan Ranganathan | 12m |
Researchers buy over 20 travel eSIMs and use trace route, Wireshark, a private LTE testbed and sysmo EUICC1 and SIMtrace2 to observe behavior. One European… | ||
| Enhanced Label-Only Membership Inference Attacks with Fewer Queries | Hao Li, Zheng Li, Siyuan Wu, Yutong Ye, Min Zhang, Dengguo Feng, Yang Zhang | 16m |
Claims that measuring boundary distance toward a fixed point and scoring it against a shadow model distribution yields a label only MIA that needs far fewer… | ||
| Rectifying Privacy and Efficacy Measurements in Machine Unlearning... | Nima Naderloui, Shenao Yan, Binghui Wang, Jie Fu, Wendy Hui Wang, Weiran Liu, Yuan Hong | 18m |
RULI introduces a dual-objective attack that measures both unlearning efficacy (does the unlearned model match a retrain reference) and privacy leakage (does… | ||
| SoK: Data Reconstruction Attacks Against Machine Learning Models... | Rui Wen, Yiyong Liu, Michael Backes, Yang Zhang | 14m |
Provides a formal definition and taxonomy for vision-domain data reconstruction, plus a benchmark that evaluates 10 attacks on models trained with 100–20,000… | ||
| McSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated... | Patrick Jattke, Michele Marazzi, Flavien Solt, Max Wipfli, Stefan Gloor, Kaveh Razavi | 10m |
Builds an automated oscilloscope-based DDR bus decoder (McSee) that captures single-cycle DDR4 and multi-cycle DDR5 traffic and uses it to measure real… | ||
| Posthammer: Pervasive Browser-based Rowhammer Attacks with Postponed... | Finn de Ridder, Patrick Jattke, Kaveh Razavi | 15m |
Posthammer implements a JavaScript Rowhammer that forces the memory controller to postpone refresh commands, uses lane eviction-set primitives to create fast… | ||
| ECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory | Nureddin Kamadan, Walter Wang, Stephan van Schaik, Christina Garman, Daniel Genkin, Yuval Yarom | 16m |
First end-to-end Rowhammer on Intel servers with Hynix DDR4 ECC memory demonstrating bit flips in an average of 25 hours and RSA key breaks in 10 hours. Uses… | ||
| GPUHammer: Rowhammer Attacks on GPU Memories are Practical | Chris S. Lin, Joyce Qu, Gururaj Saileshwar | 14m |
GPUHammer reverse‑engineers GDDR6 bank/row mapping, uses multi‑warp access patterns to reach 620k activations per refresh window, and aligns hammering to… | ||
| Breaking the Blindfold: Deep Learning-based Blind Side-channel Analysis | Azade Rezaeezade, Trevor Yap, Dirmanto Jap, Shivam Bhasin, Stjepan Picek | 20m |
Claims a practical framework, DL-BSCA, that uses deep neural nets plus a new Multi-point Cluster-based labeling to recover keys in blind side-channel settings… | ||
| Websites' Global Privacy Control Compliance at Scale and over Time | Katherine Hausladen, Oliver Wang, Sophie Eng, Jocelyn Wang, Francisca Wijaya, Matthew May, Sebastian Zimmeck | 16m |
Crawls of 11,708 sites track four signals—US Privacy String, GPP, OptanonConsent cookie, .well-known/gpc.json—to detect whether a site propagates a browser… | ||
| SpeechGuard: Recoverable and Customizable Speech Privacy Protection... | Jingmiao Zhang, Suyuan Liu, Jiahui Hou, Zhiqiang Wang, Haikuo Yu, Xiang-Yang Li | 20m |
System applies a reversible multi-parameter warping function (invertible voice conversion with randomized per-segment alpha/beta) plus automatic or manual… | ||
| Understanding How Users Prepare for and React to Smartphone Theft | Divyanshu Bhardwaj, Sumair Ijaz Hashmi, Katharina Krombholz, Maximilian Golla | 17m |
Study of 20 semi-structured interviews with recent theft victims maps preparation, immediate actions, and recovery harms: optimism bias leads people to rely on… | ||
| Security and Privacy Advice for UPI Users in India | Deepthi Mungara, Harshini Sri Ramulu, Yasemin Acar | 14m |
Study analyzes UPI security using 26 semi-structured interviews and content analysis of 16 official sources, and reports UPI handled $2.57 trillion last year… | ||
| Fuzzing the PHP Interpreter via Dataflow Fusion | Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, Zhenkai Liang | 15m |
FlowFusion is an automatic fuzzer that implements dataflow fusion by merging PHPT seed programs’ definitions and uses to create new, semantically richer tests… | ||
| Waltzz: WebAssembly Runtime Fuzzing with Stack-Invariant Transformation | Lingming Zhang, Binbin Zhao, Jiacheng Xu, Peiyu Liu, Qinge Xie, Yuan Tian, Jianhai Chen, Shouling Ji | 17m |
Waltzz implements a stack-invariant transformation so mutations preserve Wasm stack types, plus control-flow and data-flow mutators, a splicing mutator, and a… | ||
| IDFuzz: Intelligent Directed Grey-box Fuzzing | Yiyang Chen, Chao Zhang, Long Wang, Wenyu Zhu, Changhua Luo, Nuoqi Gui, Zheyu Ma, Xingjian Zhang, Bingkai Su | 11m |
IDFuzz uses a neural network to learn which input offsets matter and then mutates those fields, claiming a 2.48x median speedup on the Google Fuzzer Test Suite… | ||
| BLuEMan: A Stateful Simulation-based Fuzzing Framework for Open-Source RTOS... | Wei-Che Kao, Yen-Chia Chen, Yu-Sheng Lin, Yu-Cheng Yang, Chi-Yu Li, Chun-Ying Huang | 19m |
BLuEMan executes real open-source BLE stacks on Linux ELF binaries hooked into a Babel physical-layer simulator to scale stateful fuzzing without hardware… | ||
| ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space | Chuyang Chen, Brendan Dolan-Gavitt | 16m |
ELFuzz automatically synthesizes generation-based fuzzers via an LLM-driven evolution loop that starts from naive seed generators and iteratively applies… | ||
| Rowhammer-Based Trojan Injection: One Bit Flip Is Sufficient... | Xiang Li, Ying Meng, Junming Chen, Lannan Luo, Qiang Zeng | 10m |
Claims a practical one-bit flip Rowhammer backdoor that works on full-precision models by flipping one exponent bit in the classification layer, finding… | ||
| From Purity to Peril: Backdooring Merged Models From "Harmless" Benign... | Lijin Wang, Jingjing Wang, Tianshuo Cong, Xinlei He, Zhan Qin, Xinyi Huang | 15m |
Introduces MergeBackdoor, a two-stage training method that makes each upstream model appear clean (upstream ASRs at random-guessing level) yet causes the… | ||
| SoK: Gradient Inversion Attacks in Federated Learning | Vincenzo Carletti, Pasquale Foggia, Carlo Mazzocca, Giuseppe Parrella, Mario Vento | 17m |
Systematization of 107 papers finds 107 papers reviewed (2016–2025), defines eight threat models (passive A–E to active variants), and classifies gradient… | ||
| Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level... | Cheng-Long Wang, Qi Li, Zihang Xiang, Yinzhi Cao, Di Wang | 13m |
Proposes Interpolated Approximate Measurement (IAM), a sample-level unlearning metric that interpolates model outputs via a bounded logit map and fits those… | ||
| Addressing the Address Books' (Interdependent) Privacy Issues | Kavous Salehzadeh Niksirat, Lev Velykoivanenko, Samuel Mätzler, Stephan Mulders, Aurelia Tamò-Larrieux, Marc-Olivier Boldi, Mathias Humbert, Kévin Huguenin | 19m |
Two large surveys (N=463 and N=459) quantify real interdependent privacy in digital address books: over 90% of users grant contact access to third‑party apps… | ||
| Endangered Privacy: Large-Scale Monitoring of Video Streaming Services | Martin Björklund, Romaric Duvignau | 14m |
A protocol-agnostic monitoring system is built that collects manifest-based fingerprints, stores sliding windows of segment sizes in a k-d tree and uses a… | ||
| Bots can Snoop: Uncovering and Mitigating Privacy Risks of Bots in Group Chats | Kai-Hsiang Chou, Yi-Min Lin, Yi-An Wang, Jonathan Weiping Li, Tiffany Hyun-Jin Kim, Hsu-Chun Hsiao | 15m |
Finds that chatbots often read far more messages than needed and that when a user joins a new group there is a 3.6% chance a bot links that user to past… | ||
| EchoLLM: LLM-Augmented Acoustic Eavesdropping Attack on Bone Conduction... | Xin Yao, Kecheng Huang, Yimin Chen, Jiawei Guo, Jie Tang, Ming Zhao | 16m |
EchoLLM reconstructs bone‑conduction audio by combining a commercial mmWave radar + wireless mic with signal processing (range-beam selection… | ||
| Double-Edged Shield: On the Fingerprintability of Customized Ad Blockers | Saiid El Hajj Chehade, Ben Stock, Carmela Troncoso | 15m |
Claim: customized ad‑blocker filter selections are fingerprintable. The authors build three scriptless fingerprinting attacks (notably a CSS animation attack… | ||
| Encrypted Access Logging for Online Accounts: Device Attributions without... | Carolina Ortega Pérez, Alaa Daffalla, Thomas Ristenpart | 17m |
Proposes client-side encrypted access logging that embeds E2E-encrypted device identifiers using OS-managed keys and FIDO2-style attestations so account… | ||
| Achilles: A Formal Framework of Leaking Secrets from Signature Schemes via... | Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen, Yansong Gao, Xingliang Yuan, Haiyang Xue, Pengfei Wu, Zhonghai Wu | 12m |
Achilles formalizes Rowhammer fault injection against a generalized signature scheme G-sign, automates symbolic differential analysis and secret recovery, and… | ||
| REVDECODE: Enhancing Binary Function Matching with Context-Aware Graph... | Tongwei Ren, Ronghan Che, Guin R. Gilman, Lorenzo De Carli, Robert J. Walls | 14m |
REVDECODE converts function-matcher outputs into directed layered graphs, runs a Viterbi-inspired forward/backward pass to find maximum-weight paths, and… | ||
| BLens: Contrastive Captioning of Binary Functions using Ensemble Embedding | Tristan Benoit, Yunru Wang, Moritz Dannehl, Johannes Kinder | 16m |
BLens builds an ensemble encoder that fuses PalmTree, Dexter and CLAP representations into patch embeddings, aligns them to tokenized names via contrastive… | ||
| TRex: Practical Type Reconstruction for Binary Code | Jay Bosamiya, Maverick Woo, Bryan Parno | 10m |
TRex is a deductive constraint-based tool that reconstructs behavior-capturing types using structural types and a final type rounding step, producing pointers… | ||
| Vest: Verified, Secure, High-Performance Parsing and Serialization for Rust | Yi Cai, Pratap Singh, Zhengyao Lin, Jay Bosamiya, Joshua Gancher, Milijana Surbatovich, Bryan Parno | 13m |
Vest generates Rust zero-copy parsers and in-place serializers from an RFC-like DSL, proves memory safety plus soundness, completeness, non-malleability and… | ||
| Pig in a Poke: Automatically Detecting and Exploiting Link Following... | Bocheng Xiang, Yuan Zhang, Fengyu Liu, Hao Huang, Zihan Lin, Min Yang | 14m |
Prototype LinkZard automatically detects and exploits Windows link-following flaws using an exploration phase with IPC-driven inputs and file state fuzzing to… | ||
| A Comprehensive Formal Security Analysis of OPC UA | Vincent Diemunsch, Lucca Hirschi, Steve Kremer | 18m |
Formal model of OPC UA v1.04 and v1.05 uses ProVerif symbolic model to analyze RSA and new DH/ECC key exchange, covering secure-channel, session creation… | ||
| ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion... | Baoxiang Jiang, Tristan Bilot, Nour El Madhoun, Khaldoun Al Agha, Anis Zouaoui, Shahrear Iqbal, Xueyuan Han, Thomas Pasquier | 09m |
Orthrus is a provenance-graph IDS that pairs a GNN encoder capturing fine-grained spatio‑temporal event patterns with dependency/causality reconstruction to… | ||
| Sometimes Simpler is Better: A Comprehensive Analysis of State-of-the-Art... | Tristan Bilot, Baoxiang Jiang, Zefeng Li, Nour El Madhoun, Khaldoun Al Agha, Anis Zouaoui, Thomas Pasquier | 12m |
Eight state-of-the-art provenance-based IDSs are reimplemented in a unified framework, exposing eight systems and nine shortcomings that break practical… | ||
| CAMP in the Odyssey: Provably Robust Reinforcement Learning with Certified... | Derui Wang, Kristen Moore, Diksha Goel, Minjune Kim, Gang Li, Yang Li, Robin Doss, Minhui Xue, Bo Li, Seyit Camtepe, Liming Zhu | 13m |
Introduces CAMP, a training paradigm that maximizes the provable certified radius by optimizing a surrogate loss derived from per-step local certified radii… | ||
| A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks | Junhua Lin, Marc Juarez | 17m |
Attack requires only the public variational autoencoder used to train the diffusion model, encodes images into the intermediate latent, trains a surrogate… | ||
| The Cost of Performance: Breaking ThreadX with Kernel Object Masquerading... | Xinhui Shao, Zhen Ling, Yue Zhang, Huaiyu Yan, Yumeng Wei, Lan Luo, Zixia Liu, Junzhou Luo, Xinwen Fu | 16m |
ThreadX uses a performance shortcut that validates pointer ranges and a few condition fields instead of full object-value checks, and that allows a Kernel… | ||
| Save what must be saved: Secure context switching with Sailor | Neelu S. Kalani, Thomas Bourgeat, Guerney D. H. Hunt, Wojciech Ozga | 14m |
Sailor uses the machine‑readable Sail ISA and the Isla symbolic executor to generate instruction traces (about 3 GB traces, 20 hours symbolic execution) and an… | ||
| Treebeard: A Scalable and Fault Tolerant ORAM Datastore | Amin Setayesh, Cheran Mahalingam, Emily Chen, Sujaya Maiyya | 15m |
Treebeard presents a horizontally scalable ORAM datastore with a three‑layer proxy: a stateless router that epoch‑batches and deterministically maps requests… | ||
| ALERT: Machine Learning-Enhanced Risk Estimation for Databases Supporting... | Longxiang Wang, Lei Xu, Yufei Chen, Ying Zou, Cong Wang | 14m |
Transforms previous heuristic optimization into an ML multiclassification pipeline that trains on public auxiliary data to predict keywords online, uses… | ||
| Distributed Private Aggregation in Graph Neural Networks | Huanhuan Jia, Yuanbo Zhao, Kai Dong, Zhen Ling, Ming Yang, Junzhou Luo, Xinwen Fu | 14m |
Claims a practical distributed GNN aggregation that attains node-level differential privacy by combining secure multi-party computation with three MPC-friendly… | ||
| Red Bleed: A Pragmatic Near-Infrared Presentation Attack on Facial Biometric... | Bowen Hu, Kuo Wang, Chip Hong Chang | 14m |
A custom LCD paired with an 850 nm backlight and wire‑grid polarizers projects high‑contrast NIR video that fools enterprise Windows Hello modules from HP… | ||
| V-ORAM: A Versatile and Adaptive ORAM Framework with Service Transformation... | Bo Zhang, Helei Cui, Xingliang Yuan, Zhiwen Yu, Bin Guo | 15m |
V-ORAM presents a framework that switches between tree-based ORAMs via a service transformation protocol using real RAM as base ORAM, synchronizing metadata… | ||
| Found in Translation: A Generative Language Modeling Approach to Memory... | Grace Jia, Alex Wong, Anurag Khandelwal | 19m |
FIT treats page access traces as a language and uses a generative encoder–decoder model (BERT with pretrained weights) to translate observed page sequences… | ||
| Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety... | Zeren Luo, Zifan Peng, Yule Liu, Zhen Sun, Mingchen Li, Jingyi Zheng, Xinlei He | 15m |
Quantifies unsafe outputs on seven AIPSEs using URLs from PhishTank, ThreatBook, LevelBlue, testing 3 query types (keyword lists, natural language, direct URL)… | ||
| SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against... | Kaiyuan Zhang, Siyuan Cheng, Hanxi Guo, Yuetian Chen, Zian Su, Shengwei An, Yuntao Du, Charles Fleming, Ashish Kundu, Xiangyu Zhang, Ninghui Li | 09m |
SOFT identifies low-loss “influential” training samples after a one-epoch warm-up, flags those below a validation-loss threshold, replaces them with… | ||
| Private Investigator: Extracting Personally Identifiable Information... | Seongho Keum, Dongwon Shin, Leo Marchyok, Sanghyun Hong, Sooel Son | 12m |
A framework called Private Investigator optimizes prompts by mining a surrogate model for top 1% tokens, selecting them iteratively to build 20 diverse prompts… | ||
| FIXX: FInding eXploits from eXamples | Neil P Thimmaiah, Yashashvi J Dave, Rigel Gjomemo, V.N. Venkatakrishnan | 16m |
FIXX is a tool that takes a disclosed PHP exploit, replays it to extract the taint-style dataflow path, builds a code graph, and finds instruction similarity… | ||
| Leuvenshtein: Efficient FHE-based Edit Distance Computation with Single... | Wouter Legiest, Jan-Pieter D'Anvers, Bojan Spasic, Nam-Luc Tran, Ingrid Verbauwhede | 14m |
Leuvenshtein implements edit distance inside TFHE-style FHE by rewriting the cell recurrence into a 16-entry lookup so each cell evaluates with single PBS per… | ||
| H2O2RAM: A High-Performance Hierarchical Doubly Oblivious RAM | Leqian Zheng, Zheng Zhang, Wentao Dong, Yao Zhang, Ye Wu, Cong Wang | 15m |
H2O2RAM is a hierarchical doubly oblivious RAM construction that replaces scattered tree layouts with contiguous level tables, implements three optimized… | ||
| Efficient Ranking, Order Statistics, and Sorting under CKKS | Federico Mazzone, Maarten Everts, Florian Hahn, Andreas Peter | 16m |
Presents an algorithmic redesign for ranking, order-statistics, and sorting under CKKS that replaces swap-based methods with a SIMD re-encoding so one… | ||
| nothing matches | ||