Security papers — 2026-10-19

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

This focus is on securing autonomous vehicles from physical attacks by examining thermal side-channels and perception integrity. This is important because autonomous driving depends on safety-critical perception combined with computing that has thermal limits, and interfaces built for one task are often not secured against the other.

One key area explored involves how adversaries can exploit thermal infrared sensors used for night driving, as discussed in AKMPC. This work investigates how physical adversaries can spoof these sensors and points out that unprivileged software co-tenants can fingerprint perception workloads using thermal data from dynamic voltage and frequency scaling telemetry required for package safety.

Moving to model security, there is research on protecting trained models when they are deployed locally, as seen in AKMPC. This study shows that streaming image classifiers to field nodes can expose the trained model if an adversary seizes the device, and it details how rotating model stages can bound residency against capture by analyzing LTE traces.

Another concern involves protecting agent harnesses from covert rewriting attacks, as detailed in AKMPC. This research shows that even provenance marks can be rewritten by a large language model proposer, and survival depends on the proposer's habits rather than the mark itself.

We also look at how agents interact with external systems through the Model Context Protocol, where AKMPC examines filesystem capability laundering where tool calls can grant unintended host file access. This is related to ensuring that tool invocations adhere strictly to their declared contracts.

Finally, we see work on robust mobile app fingerprinting through traffic behavior correlation graphs in AKMPC, which proposes a method to create reliable fingerprints by modeling unit traffic behaviors and correlations. This contrasts with the more abstract security concerns found in SMT-Boosted Security Types for Multi-Party Computation in <a href="/papers/2604.01730">AKMPC</a>, which uses formal logic to enforce correctness in distributed protocols.

The Hybrid DeepXAI Fusion Network is particularly significant because it addresses the critical tension between using complex big data models for decision-making and maintaining the necessary transparency and security required for trust in those systems. This framework integrates temporal, relational, and contextual features using 1D-CNNs for time, Transformer encoders for context, and Graph Neural Networks to map feature dependencies.

The experimental evaluations showed that this network achieved very high accuracy across healthcare, finance, and energy datasets with scores like 98.42% accuracy and a 98.0% F1-score against baselines such as the CNN-LSTM and XGBoost models. Furthermore, when subjected to adversarial perturbations from projected gradient descent attacks, the model managed to keep its accuracy above 91.5%. This suggests that the architecture is robust even when facing attempts to manipulate its predictions.

The framework is designed for deployment in a federated cloud setting, incorporating homomorphic encryption and blockchain auditing to ensure data privacy and accountability. This approach builds upon work like NOMAI, which focuses on scalable federated learning with private weights, by adding a layer of interpretability directly into the analytical pipeline.

Another piece of relevant work is Blind Watermarking of Software Repositories via Module Placement, which explores embedding recoverable identifiers in software artifacts by strategically placing modules within a repository structure. This contrasts with the deep learning approach by focusing on securing source code provenance rather than model output interpretation.

The complexity of secure computation is also addressed by studies like On the Complexity of Symmetric Boolean Functions in Multiparty Private Simultaneous Messages, which establishes lower bounds for privacy-preserving message encoding protocols. This theoretical work informs the cryptographic foundations needed to secure distributed systems where data contribution is involved, much like NOMAI attempts to do at scale.

The most critical work here is ExecWeave because it tackles the fundamental problem of connecting different layers of software activity to make sense of what an agentic program is actually doing at runtime. This matters because right now, we have traces describing logical operations and telemetry describing machine activity, but linking these together reliably is hard, leading to potential misattribution of effects.

ExecWeave introduces a local-first system that builds a typed execution graph by materializing provider semantics and observing runtime events independently. This allows it to record attribution and causal status metadata alongside the events. This is significant because it moves beyond simple correlation by only emitting an inferred bridge between a command and a process when its bounded search actually finds one compatible observed process, which means we are not just guessing connections.

The work on reaction attacks against CKKS deployments is also important as it shows how subtle interactions between client-side validity responses and public keys can lead to key recovery without breaking the underlying cryptography. This attack exploits how a shift in a public encryption key changes the ciphertext such that its validity depends strictly on matching a guessed secret coefficient, even though the core RLWE security remains intact.

On another front, research into privacy accounting in RAG is crucial because it forces us to think beyond simple epsilon values when assessing privacy loss over repeated queries. It suggests that a single privacy budget doesn't capture the full picture, prompting a framework that views guarantees across granularity, scope, and release boundaries rather than just one number.

Then there is the work on LLM4SAST which uses large language models to detect faults in static application security testing tools. This is valuable because it shows how LLMs can be used for diverse code transformation to generate variants that test SAST tools better, leading to a significant reduction in false positives and detection of more faults.

We also see work exploring hardware-software leakage contracts, which aims to create a new abstraction layer between instruction set architectures and microarchitectural side effects like caches. This is foundational because it seeks to make software development provably resistant to side-channel attacks without requiring programmers to deeply understand the underlying hardware details.

Finally, the performance characterization of Pulsar's software-defined watermark verifier demonstrates a practical step toward commercial deployment by showing that their combinatorial watermark can provide 32-bit authentication security each second in real SDR receivers. This moves a theoretical security feature into tangible, deployable technology for PNT services.

The most critical finding concerns the limitations of standard graph structures in ensuring message delivery for quorum formation in committee-based blockchains, which is why understanding how gossip protocols perform under adversarial conditions matters so much. We saw that the graph parameters typically used for random graphs are simply not enough to guarantee that enough honest nodes receive consensus messages when operating at the scale of hundreds of validator nodes.

This finding motivates an empirical look at several specific dissemination methods. For instance, we assessed the robustness of Bitcoin's Erdős-Rényi (ER) graphs, Polkadot's grid topology, Ethereum's GossipSub, and Solana's chunk- and tree-based disseminations to see how they fare against realistic network adversaries.

The results showed some interesting trade-offs depending on the protocol. Solana’s dynamic trees proved bandwidth-efficient when things were benign but became fragile when facing adaptive attacks. Polkadot’s grid structure offered strong robustness but required a high bandwidth overhead, while GossipSub was both efficient and resilient to adaptive adversaries, though it remained very sensitive to parameter choices. Finally, ER graphs demonstrated a solid tradeoff between robustness and efficiency, specifically when the average fanout degree surpassed fifteen for networks up to five thousand nodes.

Today's papers

The papers

Important terms

Thermal Side-Channels
Adversaries exploit thermal infrared sensors used for night driving to fingerprint perception workloads by analyzing telemetry from dynamic voltage and frequency scaling.
Model Security/Residency
Protecting trained models deployed locally involves techniques like rotating model stages to bound residency against capture by adversaries seizing the device.
ExecWeave
This system connects different layers of software activity by building a typed execution graph, moving beyond simple correlation to reliably link commands and processes at runtime.
Graph Dissemination Robustness
Research assesses how different network topologies, like Bitcoin's ER graphs or Polkadot's grid, perform under adversarial conditions when forming consensus in large blockchains.