Security papers — 2026-10-17

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today we are diving into how we can better understand and protect small and medium enterprises because they form the backbone of our economy. These businesses are often overlooked in cybersecurity efforts despite their importance to the economy.

The systematic review by Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity looked at literature between two thousand seventeen and twenty twenty-four. This review found that research on small and medium enterprises is underdeveloped and has not made much progress in grasping their specific threats or needs.

The main hurdles identified for these businesses are a lack of awareness about risks, limited cybersecurity literacy, and tight financial resources. The analysis suggests that low literacy is the root cause linking those awareness and resource issues together.

Moving down in importance, there is work on how large language models might be used to spot code vulnerabilities. Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection explored whether the cognitive biases that affect human judgment also influence how these models assess code flaws. All tested models are susceptible to effects like the framing effect and anchoring. This susceptibility is significant because it means models can be tricked into misjudging security risks, even when they rely on pattern matching rather than deep semantic understanding.

Then there is a practical tool addressing supply chain risks: GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement introduces GoLeash. This system enforces security policies at the package level in the Go ecosystem to stop malicious dependencies from spreading, which is a direct response to modern software supply chain attacks. This granular control is more precise than traditional container-level sandboxing.

Finally, there is some work on improving search efficiency and other security areas: Identifier-Free Code Embedding Models for Scalable Search fine-tunes a Qwen3 embedding model to perform bidirectional association between source code and decompiled code. This shows substantial improvements over existing models. This contrasts with the focus on human judgment in LLMs, but both point toward the need for more robust automated analysis tools.

Today's papers

Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity Small businesses are often overlooked in cybersecurity efforts, making them vulnerable to attacks. [paper] [episode]
Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection This paper explores how human biases affect Large Language Models when they try to find bugs in code. [paper] [episode]
GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement This system uses fine-grained policies to stop malicious packages from spreading through the Go software supply chain. [paper] [episode]
Identifier-Free Code Embedding Models for Scalable Search This work develops models that can link source code and decompiled code together without needing specific preprocessing steps. [paper] [episode]
ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning This attack shows how malicious clients can collude to bypass security measures in federated self-supervised learning models. [paper] [episode]
Post-Quantum Secure Aggregation via Code-Based Homomorphic Encryption This protocol allows servers to securely sum user inputs without revealing individual data using code-based encryption. [paper] [episode]
Password Strength Detection via Machine Learning: Analysis, Modeling, and Evaluation This study uses machine learning to classify passwords as strong or weak based on various characteristics. [paper] [episode]
An Empirical Analysis of EOS Blockchain Architecture, Contract, and Security This research thoroughly examines the architecture and security issues of the EOS blockchain system. [paper] [episode]

The papers

Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity — As a fastidious and diligent AI researcher, I have meticulously analyzed both provided texts to synthesize a comprehensive summary of the paper "Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity." Here is the detailed synthesis: * Comprehensive Summary of [episode]
Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection — The gist The first systematic investigation of cognitive heuristics in LLM-based code vulnerability detection reveals that all evaluated models are susceptible to these heuristics, and cognitive susceptibility is a consistent and exploitable property of LLM-based vulnerability de [episode]
GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement — The gist GoLeash is a novel system that applies runtime policy enforcement at the package-level granularity to mitigate software supply chain attacks in Go. [episode]
Identifier-Free Code Embedding Models for Scalable Search — The gist The paper presents a framework for evaluating how well embedding models can associate source code functions with their decompiled, stripped counterparts that lack identifiers like variable, parameter, and function names. [episode]
ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning — The gist The Attention-Driven multiparty Collusion Attack (ADCA) proposes a novel distributed backdoor attack for Federated Self-Supervised Learning (FSSL) that leverages trigger decomposition and an attention mechanism to mitigate the dilution of backdoor information during mode [episode]
Post-Quantum Secure Aggregation via Code-Based Homomorphic Encryption — The gist: A code-based alternative for secure aggregation by instantiating a general framework based on key- and messageadditive homomorphic encryption under the Learning Parity with Noise (LPN) assumption is presented, which is shown to be equivalent to standard LPN for suitable [episode]
An Empirical Analysis of EOS Blockchain: Architecture, Contract, and Security — The gist: This study conducts a comprehensive investigation of the EOS blockchain from five key dimensions: system architecture, decentralization, performance, smart contracts, and behavioral security. [episode]
Password Strength Detection via Machine Learning: Analysis, Modeling, and Evaluation — The gist: Decision trees and stacked models excel in accuracy, recall, and F1 score, making them a practical option for the strong and weak password classification task Introduction This study aims to analyze data from public password repositories to understand the characteristic [episode]

Important terms

SME Cybersecurity: This refers to the specific threats and needs faced by small and medium enterprises, which are often overlooked in cybersecurity efforts because they form the backbone of our economy.
Cybersecurity Literacy: This is a key hurdle where businesses lack the knowledge or education needed to understand and manage potential cybersecurity risks effectively.
Cognitive Heuristics in LLMs: These are mental shortcuts that affect human judgment, which research shows can also influence how large language models assess and detect code vulnerabilities.
Supply Chain Attacks: These are malicious attacks targeting the software supply chain, where bad dependencies spread through a system, requiring precise mitigation methods like GoLeash.
Code Embedding Models: These are advanced models that create numerical representations of source and decompiled code to improve search efficiency and bidirectional association between the two.