Security papers — 2026-10-14

Today's focus is on building reliable guardrails around delegated large language model agents because the risk of them misbehaving while handling sensitive data is a major concern. The work that matters most is DelegateGuard, which introduces a reference monitor that converts user authorization into constraints based on purpose, labels, operations, sinks, and delegation depth. This system blocks actions like unauthorized data exfiltration or authority amplification by mediating every data-moving action outside the LLM and managing revocation cascades through the delegation graph DelegateGuard.

This mechanism is significant because it provides a model-independent execution boundary for these workflows. It gives us a precise recipe for composing them with content monitoring DelegateGuard. It has shown strong results against various attacks, such as blocking ungranted-sink exfiltration and intra-tool label violations, dominating static allowlists in those specific cases.

Another piece of work deals with ensuring data integrity when generating large amounts of tabular information through Watermarking Continuous Tabular Data Generation Watermarking Continuous Tabular Data Generation. This method embeds watermarks into selected feature intervals to create a simple yet effective mechanism for detecting the watermarks while preserving data fidelity against noise attacks.

We also have research exploring vulnerabilities in model merging, specifically One-sided Merging-Conditional Backdoor Unalignment Towards Merging-conditional Backdoor Unalignment against Large Language Models. This work reveals a critical threat where backdoors can activate only after models are merged. It proposes SMOKE as an attack framework to implant this vulnerability, contrasting with DelegateGuard by focusing on model structure rather than runtime delegation authority.

The most important thing to look at is how we can reliably extract actual tactics from threat intelligence, which is what CTI2TTP aims to do because understanding adversary methods is key. This work tries to build a system that pulls real tactics out of cyber threat intelligence by using a diverge-then-converge verification process. This matters because it moves beyond simple pattern matching to give us evidence-grounded insights into how threats operate.

The jailbreak foundry paper Jailbreak Foundry is also significant because it solves the problem of stale benchmarks in large language models. It creates a system that translates jailbreak papers into runnable attack modules for immediate testing, helping keep up with evolving techniques. It achieves a high fidelity with mean attack success rate deviation of plus zero point two six percentage points across thirty reproduced attacks.

Another piece is DICE which explores the boundary where interface attacks can succeed against System One models by tilting the odds through specific adapter outputs in a Jev-based pipeline. This study shows that even with checks binding relationships, correct request-level judgments can lose their connection to the original task, highlighting failures in source fidelity and answer meaning.

Finally, we have One Skill, Two Masters which looks at serving both users and attackers through skill injection. This work investigates how skills can be injected to serve two different masters simultaneously.

The most pressing concern today revolves around how agents can be tricked into accepting malicious information, which is crucial because it speaks directly to the security of autonomous systems. This is explored in the work titled When External Threats Become User Context, which investigates methods for tricking agents into accepting harmful inputs.

A key finding from this area relates to prompt engineering strategies used to bypass security defenses, as detailed in An Empirical Case Study of Prompt Engineering Strategies for Bypassing Multi-Layer Agent Security Defenses ACPS. This study empirically examined how specific prompting techniques can circumvent multiple layers of agent security. It suggests that sophisticated user input manipulation is a viable attack vector, showing existing defenses might not be robust against clever conversational steering.

Furthermore, we see related work focusing on the identity and accountability of these agents through Who is the 'I' in AI? Establishing Decentralized Identity and Accountability for Autonomous Agents WIIA. This paper deals with establishing decentralized identity for autonomous agents, which is important because if we can track who is making decisions, accountability becomes clearer when malicious information is accepted.

Another piece of research addresses the detection of deceptive reasoning models through Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models HPAAM. This work focuses on making reasoning models harder to detect when they are trying to hide malicious intent, which is a necessary countermeasure against the prompt engineering attacks mentioned earlier.

Finally, there is the work on SkillScreen: High-Recall Screening of Malicious Agent Skills with Decision Models SS. This model uses decision models to screen for malicious agent skills, providing a way to proactively identify dangerous capabilities before they are deployed in a context where external threats might be present.

The most critical development concerns how we can build provably safe agentic systems, as agentic computing is rapidly becoming central to many applications. A novel method for enforcing policies at runtime by constructing event graphs allows users to specify intended behavior in Datalog and block actions that violate that policy based on the system state and history Formal Policy Enforcement for Agentic Systems. This is a significant step toward creating systems that are not just secure but provably safe, as it moves beyond coarse-grained checks to dynamic enforcement during execution.

This work on agent security is complemented by research into how representation-based defenses perform against backdoor attacks in federated learning settings When Does Trust Help? A Leakage-Free Evaluation of Representation- and Aggregation-Based Defenses Against Backdoors in Federated Intrusion Detection. The study found that a representation similarity aggregator, RepGuard, significantly improved classification utility and seed stability over other trust-based defenses under heavy non-IID poisoning scenarios. However, this benefit diminishes when facing strong trigger magnitudes.

Moving toward practical application, the ability to recover text from degraded images is a major bottleneck for forensic analysis Forensic Text Recovery from Document Thumbnails Using Text-Aware U-Net. This research proposes a U-Net architecture that uses an OCR based Normalized Levenshtein Distance metric during model selection to prioritize recovering accurate character topology over simple pixel smoothness Forensic Text Recovery from Document Thumbnails Using Text-Aware U-Net. This method shows a significant reduction in the NLD metric, enabling better recovery from severely degraded document thumbnails.

Furthermore, we are seeing advancements in threat intelligence gathering across disparate sources TIBlender: Early-Warning Threat Intelligence from Cross-Platform Social Media Evidence. TIBlender is a multi agent system that monitors platforms like X, Reddit, Telegram, and Discord to produce structured threat intelligence reports through specialized LLM agents TIBlender: Early-Warning Threat Intelligence from Cross-Platform Social Media Evidence. The findings confirm that monitoring these platforms in a multi perspective allows for the detection of emerging threats ahead of public feeds.

The work that matters most right now is Purpose IR because it directly addresses the core problem of defining what information an agent state should keep versus what should be released. This concept becomes vital when thinking about how LLM-agent workflows generate plans and memories; these workflows create a privacy boundary that simple task relevance doesn't capture, leading to what the authors term the purpose-to-state semantic gap. Purpose IR tackles this by creating a bounded typed intermediate representation that compiles natural language user purpose into an executable semantic boundary for reusable agent state.

This means they are not just filtering sensitive content but explicitly defining what the user's goal authorizes to survive in that state, which is a much stronger guarantee than just filtering out irrelevant data. Purpose IR achieved 99.6 percent Privacy and 83.3 percent Task success across one thousand two hundred cases spanning LangGraph, CrewAI, and MobileRun, significantly outperforming the strongest high-privacy baseline by twenty-seven point five percent in privacy-compliant success points.

The work on TRAP also contributes to this area by focusing on adversarial robustness, although it operates in a different domain. TRAP presents a hierarchical framework for automated jailbreak strategy discovery, organizing established methods into a semantic strategy tree and using reinforcement learning to guide the selection of attack paths based on evaluator feedback. This helps identify weaknesses in aligned LLMs by connecting broad approaches to concrete strategies.

Another piece of work touches upon the technical aspects of sequence construction in intrusion detection, offering a different perspective on data representation. Beyond Model Scaling: Rethinking Sequence Construction for Transformer-based Network Intrusion Detection proposes a unified pipeline abstraction that decomposes NIDS into four design dimensions and introduces session-coherent temporalization to construct sequences from communication sessions rather than fixed time windows. This suggests that how we structure the input sequence is a primary design decision for performance.

The most pressing concern today revolves around how agents can exploit knowledge pathways for leakage and how we can protect those systems, which is central to the work of When Agents Talk, Secrets Travel. This paper investigates topology-driven leakage in multi-agent LLM systems, showing that the way agents communicate dictates where sensitive information might escape. It suggests that understanding these communication structures is key to mitigating risks when agents interact.

Building on this, there is a significant effort to create defenses against malicious prompting through ATTCK-R, which proposes knowledge-aware long-horizon jailbreaking for protected LLMs ATTCK-R. This work attempts to find ways to bypass safety guardrails by crafting sophisticated prompts that leverage the model's knowledge in a controlled, yet potentially harmful, manner.

Another critical area is securing skills and capabilities against exploitation, as explored in Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher. This research highlights the danger that even encrypted abilities can become vulnerabilities if an agent gains the capability to decipher them.

Then we have practical methods for protecting data privacy, specifically differential privacy applied to preference alignment using survey derived data in Differential Privacy Protected Preference Alignment on Survey Derived Data. This method aims to ensure that aligning models with preferences does not inadvertently leak sensitive information about the underlying survey responses.

Finally, we see work addressing physical security risks, such as the comprehensive survey of security risks in edge-deployed audio LLM-based agents From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agents. This review looks at the broader landscape of risks when these agents are deployed in real-world, physical environments.

The most significant development concerns how to secure synthetic data against privacy leaks, particularly in the context of large language models. Tight End-to-End Accounting for Differentially Private Synthetic Data Tight End-to End Accounting for Differentially Private Synthetic Data addresses this by providing a framework for accounting for differentially private synthetic data, which is crucial when training or fine-tuning models on sensitive information. This work suggests a method to track privacy guarantees throughout the entire simulation process.

This idea of tracking data provenance and security extends to agent interactions with language models through Dependency-Aware Privacy for Multi-turn LLM Agents Dependency-Aware Privacy for Multi-turn LLM Agents. This explores how to maintain privacy when agents interact with LLMs over multiple turns, focusing on dependency tracking within the agent's memory or context. This is important because agents can accumulate sensitive information across a conversation history.

Another area of concern is ensuring that models themselves are not easily manipulated or compromised, which brings us to image protection in open-weight diffusion models. Beyond user-side defenses, Image Protection in Open-Weight Diffusion Models Beyond User-Side Defenses: Image Protection in Open-Weight Diffusion Models investigates methods for protecting images generated by these models, which is vital given the accessibility of open weights.

Finally, there is the practical issue of verifying the authenticity of text that has been watermarked for detection. ByteMark ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models proposes a unified watermarking scheme embedded in the UTF-8 bytes of published text. This allows a single detector to verify the text regardless of the specific tokenizer or embedding model used by the original provider, contrasting with older methods.

The most pressing development is the work on NeuroLog because it directly addresses how we can audit reasoning processes within large language models, which is crucial for building trustworthy AI systems. This research uses facts from LLMs, Datalog, and SMT solvers to discover vulnerabilities in a way that makes the reasoning path transparent.

P2Skill explores privacy-preserving skill distillation for cloud-local LLM inference systems. This means they are trying to transfer complex skills from large models into smaller, local ones while keeping the underlying data private. This contrasts with the work on SoK, which focuses on systematizing LLM prompt security by creating taxonomies and unified evaluations for both attacks and defenses.

The exploration of vulnerabilities in Solana smart contracts is also significant because it highlights real-world security risks in decentralized systems. This study examines potential weaknesses within those specific contract structures. Furthermore, the comparative analysis of blockchain systems provides a broader context for understanding system-level security concerns across different architectures.

Penetration testing for system security offers practical methods and approaches for finding flaws in existing software; this work focuses on establishing these methodologies. Immutable digital recognition via blockchain is another area that builds trust by using blockchain technology to create verifiable digital identities. Finally, detecting data exfiltration through I2P anonymity networks employs a two-phase machine learning approach to spot unauthorized data movement.

Today's papers

The papers

Important terms

DelegateGuard
A reference monitor for LLM agents that converts user permissions into constraints based on purpose, labels, and delegation depth to block unauthorized actions like data exfiltration.
Purpose IR
A method for defining what information an agent state should keep versus release by creating a bounded typed intermediate representation. This creates a stronger privacy guarantee than simple content filtering.
Watermarking Continuous Tabular Data Generation
A technique that embeds watermarks into selected feature intervals of tabular data to allow for detection while maintaining data fidelity against noise attacks.
Formal Policy Enforcement for Agentic Systems
A novel method using Datalog and event graphs to enforce policies at runtime. This allows users to specify intended behavior and dynamically block actions that violate the policy based on system state.