Security papers — 2026-10-22

The Morning Preprint — this day as one edition: the day's papers, the five things worth knowing, and the episodes behind them.

Today we are diving into how we can protect intellectual property within large language models because the risk of adversaries replicating proprietary models by training surrogate ones is significant. The work that matters most here is SAFESEAL, which introduces a novel key-conditioned watermarking framework designed to achieve strong detectability while keeping the impact on model utility minimal.

This framework works by substituting linguistic terms with context-aware synonyms using a key-conditioned Tournament sampling mechanism. This process preserves semantic fidelity and factual consistency while maintaining named entities.

This approach is supported by the findings in SAFESEAL, which showed that it achieves a BERTScore of 0.983 and a 98.2% detection rate. This method outperforms baselines in utility and robustness while maintaining latency comparable to the fastest methods.

This method is complemented by VertMark, which proposes a unified training-free watermarking framework for vertical domain pre-trained language models. It embeds ownership-encoded watermarks through a training-free parameter replacement strategy. This strategy shows strong robustness against attacks like pruning and quantization.

We also have research into how memory affects agent behavior, specifically the study on Memory-Induced Tool-Drift in LLM Agents. This study found that personality preferences stored in memory can silently shift tool parameters, causing significant parameter degradation when used in complex scenarios.

This drift is explored through the MEMDRIFT benchmark, where biased memories induced degradation rates up to 0.83 compared to neutral memories. Finally, we have work on privacy in federated learning, specifically the analysis of Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning. This work developed a defense strategy that perturbs transmitted logits to minimize privacy risk while maximizing training performance.

The most significant finding is the proposal of a novel schedule obfuscation strategy called Hide-n-Seek which directly addresses timing side channels in CAN protocols. This is crucial because these timing leaks allow for schedule-based denial-of-service or man-in-the-middle attacks by exploiting the deterministic scheduling decisions made by Electronic Control Units.

This strategy works by randomly shifting the victim task instance and skipping certain control task executions and their related data transmissions. The number of skips is carefully bounded to maintain performance.

This approach is supported by experimental validation in a real-time Hardware-in-loop setup where they applied this attack-aware schedule obfuscation strategy Hide-n-Seek to synthesized automotive task sets. Another method provides a principled way to intentionally skip control loop executions as a control theoretic countermeasure against stealthy attacks that violate message integrity and authenticity.

This technique, detailed in Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions, helps lower the overhead of cryptographic security measures in CAN based automotive cyber-physical systems without sacrificing performance or safety.

Today's papers

Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection: This research proposes a new watermarking method that protects large language models' intellectual property while keeping the model useful. [paper] [episode]
Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals: This paper shows how dormant malware in LiDAR sensors can be remotely triggered to cause false data injection. [paper] [episode]
Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning: This work analyzes and defends against a privacy risk where a server might learn private client models from shared model outputs during federated learning. [paper] [episode]
An AI Security Agent for University ACMIS: Multi-Vector Threat Detection and Automated Response: This paper introduces an AI agent to detect and automatically respond to various security threats in university management systems. [paper] [episode]
Memory-Induced Tool-Drift in LLM Agents: This study investigates how stored personality traits in memory can cause LLM agents to incorrectly change their tool usage over time. [paper] [episode]
VertMark: A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models: This framework provides a training-free way to embed copyright protection into specialized language models across different domains. [paper] [episode]
Multi-User Multi-Key Image Steganography with Key Isolation: This paper extends image steganography to allow multiple users to hide secret information while ensuring keys remain isolated. [paper] [episode]
VDDP: Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup: This research develops a framework for verifiable differential privacy in distributed systems to prevent malicious server behavior. [paper]
Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks: This work proposes a strategy to hide control task timing information in CAN networks to prevent schedule-based denial of service attacks. [paper] [episode]
Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions: This paper suggests intentionally skipping control loop executions as a countermeasure against stealthy attacks in automotive systems. [paper] [episode]

The papers

Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection — The gist: SAFESEAL is a novel key-conditioned watermarking framework that achieves strong detectability with minimal impact on model utility, effectively balancing detectability, utility, and robustness. [episode]
Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks — The gist This work focuses on eliminating timing-side channels in real-time safety-critical cyber-physical network protocols like Controller Area Networks (CAN) by proposing a novel schedule obfuscation strategy called Hide-n-Seek to prevent schedule-based attacks such as bus-off [episode]
VDDP: Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup — Detailed Research Summary of "Verifiable Distributed Differential Privacy (VDDP)" This research introduces Verifiable Distributed Differential Privacy (VDDP), a novel framework designed to address malicious behaviors within distributed differential privacy (DP) mechanisms operati
Multi-User Multi-Key Image Steganography with Key Isolation — The gist: PUSNetMK, a multi-key extension of PUSNet, proposes a method to enforce strict key isolation in multi-user image steganography by introducing a mismatched-key isolation loss that suppresses cross-key decoding; this design preserves the intended steganographic behavior w [episode]
VertMark: A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models — The gist The paper proposes VertMark, a unified training-free robust watermarking framework for Vertical Domain Pre-trained Language Models, which establishes hidden semantic-equivalence mappings between low-frequency trigger tokens and high-frequency domain-relevant tokens via a [episode]
Memory-Induced Tool-Drift in LLM Agents — The second text appears to be an excerpt from a specific analysis tool or a structured output generated by an agent analyzing the findings for a particular tool. [episode]
Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning — The gist: This research presents a first theoretical and empirical analysis of a hidden privacy risk in logit-based FL methods, specifically that a semi-honest server may learn clients’ private models from logits during training. [episode]
An AI Security Agent for University ACMIS: Multi-Vector Threat Detection and Automated Response — The gist The proposed AI security agent for University ACMIS combines supervised anomaly detection, behavioural analytics, and an NLP chatbot to detect multi-vector threats in academic management information systems. [episode]
Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions — The gist: The proposed framework introduces intentional skipping of control loop executions as a control-theoretic countermeasure against stealthy attacks that violate message integrity and authenticity in cyber-physical systems. [episode]
Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals — The gist The work demonstrates that dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal, without requiring network access or sustained attacker interaction during attack execution. [episode]

Important terms

SAFESEAL: A novel key-conditioned watermarking framework for LLMs that uses context-aware synonyms to embed ownership information. It balances strong detectability with minimal impact on the model's ability to perform its intended tasks.
VertMark: A training-free watermarking method for vertical domain pre-trained language models. It embeds ownership marks by replacing parameters without needing any additional training, offering robustness against attacks like pruning and quantization.
Memory-Induced Tool-Drift: The phenomenon where personality preferences stored in an LLM's memory can silently change how it uses tools. This causes significant performance degradation when the model operates in complex situations, as shown by the MEMDRIFT benchmark.
Hide-n-Seek: A schedule obfuscation strategy for CAN protocols that addresses timing side channels. It works by randomly shifting task instances and skipping control executions to prevent denial-of-service attacks without major performance loss.