Daily Summary for 2026-10-19

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: It's the nineteenth of October, twenty twenty-six, and this is the day's research.

Elias: 25 new papers came out today.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We'll take the day in one pass, then pull out the papers we're staying with.

Elias: Start us off with When Rotation Bounds Nothing.

The summary: Nadia: Welcome. Today is the nineteenth of October, twenty twenty six.

Elias: The survey frames thirteen works into areas like thermal perception integrity and telemetry leakage.

Priya: It distinguishes between attack families and adversary classes while mapping defenses to residual risk.

Nadia: This survey keeps thermal management operational while framing these issues.

Elias: A key concern is how physical adversaries can spoof infrared sensors in autonomous vehicles for night driving.

Priya: Interfaces built for night perception were never designed as confidentiality boundaries, leaving other paths intact.

Nadia: This contrasts with unprivileged software co-tenants fingerprinting workloads using thermal data and telemetry.

Elias: They use dynamic voltage and frequency scaling telemetry and thermal event interrupt telemetry for package safety.

Priya: Further down the list is work on model theft where streaming image classifiers expose trained models to theft via volatile memory rotation.

Nadia: This shows that a chunkable multi-exit model can still be captured if it streams into volatile memory.

Elias: The adversary gains usable CIFAR-100 seizures at high rates over time in that scenario.

Priya: Another concern involves agent harnesses leaking information through covert rewriting attacks.

Nadia: Provenance marks can be rewritten by large language models, allowing a plagiarist to pass a leaked harness.

Elias: This suggests selection protects marks only when each decision sees enough games.

Priya: Mobile app fingerprinting is countered with MAppPrint which proposes a behavior-level traffic fingerprinting framework.

Nadia: It improves app fingerprinting precision by incorporating unit traffic behaviors and correlation graphs.

Elias: This relates to inference as seen in MAppPrint's work on robust and real-time mobile app fingerprinting.

Priya: Finally, security types can be enforced in secure multi-party computation protocols using SMT-Boosted Security Types.

Nadia: This develops a new Hoare logic to automatically enforce correctness and confidentiality properties in protocols.

Elias: The Hybrid DeepXAI Fusion Network tackles the tension between big data models and understanding their decisions for trust.

Priya: It merges temporal features from CNNs with contextual modeling from Transformer encoders using graph neural networks.

Nadia: This architecture uses an attention-based fusion mechanism to combine representations and adds an explanation loss.

Elias: The setup is designed for deployment in a federated cloud architecture using homomorphic encryption and blockchain auditing.

Nadia: The network achieved ninety-eight point four two percent accuracy.

Elias: That performance beats CNN-LSTM, Transformer-only, and XGBoost baselines.

Priya: Under adversarial attacks, accuracy stayed above ninety-one point five percent.

Nadia: Scalability tests show eighty thousand messages per second with low latency.

Elias: This suggests promise for secure decision-support systems in the cloud.

Priya: ExecWeave tackles tracing agentic software execution across evidence planes.

Nadia: It builds a local-first system creating a typed execution graph.

Elias: It materializes provider semantics and observed runtime events there.

Priya: This separates logical operations from raw telemetry for better understanding.

Nadia: It addresses ambiguity when application traces describe logic only.

Elias: OS telemetry records machine activity, which is a different view indeed.

Priya: OS effects are assigned after linking processes via command-to-process association.

Nadia: This is more rigorous than observing session-correlated file system events.

Elias: A concern exists with the reaction attack on CKKS deployments.

Priya: That attack recovers a ternary secret key using optimal O H reaction queries.

Nadia: Observable validity reactions show a practical key-recovery channel in CKKS.

Elias: This exposes a surface vulnerability contrasting RAG privacy accounting work.

Priya: The survey moves beyond simple epsilon reporting for differential privacy in RAG systems.

Nadia: It proposes a framework interpreting guarantees across three dimensions there.

Elias: This helps users understand trade-offs between privacy and utility in multi-query systems.

Priya: Hardware security looks at hardware-software leakage contracts at the instruction set architecture level.

Nadia: This abstraction allows programmers to generate code resistant to side-channel attacks.

Elias: It does so without needing explicit knowledge of the underlying microarchitecture.

Nadia: The Pulsar verifier shows feasible commercial implementation for GNSS receivers using an SDR platform.

Elias: That demonstrates practical application for securing positioning services.

Priya: PAGE404 reveals side-channel vulnerabilities in NVIDIA's Grace Hopper architecture across MIG partitions.

Nadia: It exposes a security gap in hardware-managed heterogeneous memory systems.

Elias: The graph structures in gossip protocols affect honest node messages for blockchain consensus integrity.

Priya: Sparse or poorly connected networks can cause Byzantine fault-tolerant systems to fail quorum.

Nadia: We assessed Bitcoin's Erdős-Rényi graphs and Polkadot's grid topology against realistic attacks.

Elias: The parameters in these random models are often inadequate for guaranteeing message delivery for quorum formation.

Priya: Solana’s dynamic trees proved bandwidth-efficient but became fragile under adaptive attacks.

Nadia: Polkadot's grid achieved strong robustness but incurred a high bandwidth overhead.

Elias: GossipSub in Ethereum was both efficient and resilient though sensitive to chosen parameters.

Priya: ER graphs showed a tradeoff between robustness and efficiency when fanout exceeded fifteen nodes.

Nadia: Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks shows thermal risks in compute.

Elias: This paper describes streaming image classifiers into volatile memory to limit adversary capture during physical seizure.

Priya: What Survives Self-Evolution investigates how provenance marks survive copying and rewriting attacks by analyzing proposer habits.

Nadia: My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale introduces detection for AI agent misuse of tool permissions.

Elias: From Detection to Decision evaluates probabilistic models for blocking prompt injections in large language models.

Priya: Poisoning the Neighborhood presents an attack exploiting graph structure of retrieval systems to poison knowledge bases.

Nadia: Hybrid DeepXAI Fusion Network proposes a framework combining feature types with explainable AI for secure cloud decision-making.

Elias: Blind Watermarking of Software Repositories via Module Placement introduces embedding identifiers by strategic module placement.

Priya: NOMAI presents a scalable multi-party computation system protecting model, data, and integrity privacy in federated learning.

Nadia: On the Complexity of Symmetric Boolean Functions in Multiparty Private Simultaneous Messages provides bounds on communication complexity.

Elias: Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks shows thermal risks in compute.

Priya: When Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture describes streaming image classifiers into volatile memory.

Nadia: What Survives Self-Evolution investigates how provenance marks survive copying and rewriting attacks by analyzing proposer habits.

Elias: My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale introduces detection for AI agent misuse of tool permissions.

Priya: Poisoning the Neighborhood presents an attack exploiting graph structure of retrieval systems to poison knowledge bases.

Nadia: Hybrid DeepXAI Fusion Network proposes a framework combining feature types with explainable AI for secure cloud decision-making.

Elias: Blind Watermarking of Software Repositories via Module Placement introduces embedding identifiers by strategic module placement.

Priya: NOMAI presents a scalable multi-party computation system protecting model, data, and integrity privacy in federated learning.

Nadia: On the Complexity of Symmetric Boolean Functions in Multiparty Private Simultaneous Messages provides bounds on communication complexity.

Elias: Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks shows thermal risks in compute.

Priya: When Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture describes streaming image classifiers into volatile memory.

Nadia: What Survives Self-Evolution investigates how provenance marks survive copying and rewriting attacks by analyzing proposer habits.

Elias: My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale introduces detection for AI agent misuse of tool permissions.

Priya: Poisoning the Neighborhood presents an attack exploiting graph structure of retrieval systems to poison knowledge bases.

Nadia: Hybrid DeepXAI Fusion Network proposes a framework combining feature types with explainable AI for secure cloud decision-making.

Elias: Blind Watermarking of Software Repositories via Module Placement introduces embedding identifiers by strategic module placement.

Priya: NOMAI presents a scalable multi-party computation system protecting model, data, and integrity privacy in federated learning.

Nadia: On the Complexity of Symmetric Boolean Functions in Multiparty Private Simultaneous Messages provides bounds on communication complexity.

Elias: Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks shows thermal risks in compute.

Lucky paper: 2610.21276: Nadia: We're looking at When Rotation Bounds Nothing from Daniel Gilkarov and Ran Dubin.

Elias: This paper deals with physical capture threats to autonomous vehicles by examining thermal side-channels and perception integrity.

Priya: The threat model here is a field-capture scenario where the operator owns the node, but the adversary gains access only upon seizure.

Nadia: It inverts traditional device ownership assumptions because recovery becomes a race against a bounded residency window.

Elias: The architecture involves chunkable network models with an ordered set of chunks c1 through cn, where b1 is less than or equal to b2, and so on.

Priya: After receiving the prefix c1 through ck, the device runs a valid forward pass with served accuracy ak, which is monotone in k.

Nadia: The rotation mechanism happens with a period R; on each rotation, the device discards the resident model before re-streaming from c1 again.

Elias: This means a node holds at most one prefix at a time, and its depth is limited by how much data has been delivered since the last rotation.

Priya: A seizure at any arbitrary instant recovers only the prefix resident in that current rotation, which is why the residency window R bounds what's recovered.

Nadia: The paper explores two adversaries: a passive one and an adaptive one who can reconstruct withheld stages.

Elias: The adaptive adversary gets most by seizing shallow prefixes and fine-tuning them with in-distribution labeled data up to the victim’s full training set.

Priya: Against a from-scratch victim, the uncaptured stages must be learned, and the adaptive adversary gains at least eighty-six point eight percent usable seizures at a thirty second rotation period.

Nadia: When using a model sliced from a public pre-trained backbone, the adversary can download those stages and recover more than ninety percent of maximum accuracy.

Elias: That's because the public prior causes the collapse, meaning the victim does not benefit from delivery-side secrecy or public-backbone deployment compatibility.

Priya: The paper concludes that when an image classifier is streamed into volatile memory and never persisted, a physical seizure recovers only the prefix resident at that instant.

Nadia: The cost of recovering the rest depends entirely on what that remainder is at the moment of capture.

Elias: The evaluation compared two victim regimes: one from scratch and one using a pretrained model fine-tuned into stages one through four.

Priya: The pretrained victim is stronger, showing an accuracy rise from zero point nine two five six to zero point nine four two eight on CIFAR-ten and from zero point six nine five one to zero point seven seven two six on CIFAR-one hundred over the same payload size at no peak accuracy cost.

Nadia: The passive capture envelope collapses once the withheld stages have a public origin, which is a key finding here.

Elias: The analysis shows that the mobileNet frontier from scratch is not protectable at any rotation we test because P(full) is zero point eight two six at R=thirty seconds even on the slower link.

Priya: The CIFAR-one hundred result requires the victim's full fifty thousand-image labeled training set to be fully protected under those conditions.

Nadia: Several limitations include whether fine-tuned stages end far from their public origin and whether the CIFAR-one hundred collapse needs that massive dataset.

Elias: The evaluation is limited to CIFAR-scale image classification only, covering no language or generative model security concerns.

Priya: The energy model is analytic, using stated constants rather than measured power traces for performance characterization.

Lucky paper: 2610.22047: Nadia: So we’re looking at SMT-Boosted Security Types and Correctness for Low-Level MPC today.

Elias: This framework uses Hoare logic and type theory to automatically enforce correctness and confidentiality in protocols written in Prelude/Overture.

Priya: The key innovation is using SMT solvers, specifically cvc5 Bit-Vector theory, to analyze low-level MPC protocols with high precision.

Nadia: It builds a two-tiered language structure: Overture for defining message passing and Prelude for compositional metaprogramming.

Elias: Overture has specialized share and integrity type systems that directly enforce noninterference modulo output and malicious security.

Priya: The authors introduce a novel share type system that enforces noninterference modulo output as a direct consequence of type safety, which works for any secret sharing scheme.

Nadia: And they layer on an integrity type system that explicitly enforces malicious security by combining the share and integrity typability.

Elias: This probabilistic modeling uses probability mass functions to precisely define key security concepts like noninterference modulo output and integrity.

Priya: They show that compositional verification is better than whole-program analysis because omitting postconditions reduces complexity back to a prior whole-program approach.

Nadia: The performance gains are significant, showing improvements of orders of magnitude when verifying large circuits using techniques like Beaver triples and BDOZ style MACs.

Elias: They found that the Bit-Vector theory solver performed better for certain circuit types compared to SMFF solvers.

Priya: What this means is a robust, automated framework where Prelude Hoare logic and type theory can enforce compositional security properties in low-level MPC protocols.

Lucky paper: 2610.22148: Nadia: Okay, let’s look at MAppPrint now. This paper is about robust and real-time mobile app fingerprinting using a Traffic Behavior Correlation Graph, or TBCG.

Elias: So the core idea is modeling behavior-level traffic correlations to get reliable app fingerprints across dynamic and multi-app scenarios.

Priya: They define unit traffic behaviors as a sequence of a few consecutive packets with small inter-arrival times that share the same direction in a bidirectional flow.

Nadia: Those sequences are the basic analysis units for building this Traffic Behavior Correlation Graph, or TBCG.

Elias: Then they introduce three fundamental correlations that form the edges: Sequential Correlation, Triggering Correlation, and Concurrent Correlation.

Priya: The sequential correlation happens if two behaviors belong to the same flow and are temporally consecutive with an inter-arrival time less than a threshold.

Nadia: That's sequential correlation defined by flow membership and temporal closeness under a specific time limit.

Elias: The triggering correlation occurs when two behaviors belong to different flows, i equals j, they are temporally consecutive with no overlap of lasting times, and their inter-arrival time is less than a threshold.

Priya: And the concurrent correlation happens if two behaviors belong to different flows, i equals j, they are temporally consecutive and have an overlap in lasting times.

Nadia: So you have these three specific rules defining the edges of your TBCG structure.

Elias: To make this real-time, MAppPrint incorporates a fingerprint compression algorithm that transforms each TBCG into a compact graph by selectively aggregating redundant information.

Priya: That compression algorithm selects redundant nodes and edges based on behavior similarity to preserve critical fingerprint information while improving throughput with minimal impact on AF accuracy.

Nadia: It’s about reducing the graph size without losing the necessary features for identification.

Elias: To handle mixed traffic, they use an unsupervised decomposition strategy that leverages inter-flow similarities to disentangle multi-app TBCGs into individual single-app TBCGs.

Priya: This decomposition removes all triggering and concurrent correlations to isolate the single-app TBCGs for subsequent classification.

Nadia: Then they use a GNN consisting of two stacked Graph Attention layers and a Graph Pooling Layer to predict app labels.

Elias: The system differentiates single-app versus multi-app traffic by comparing the similarity of the predicted probability distribution to a one-point probability distribution.

Priya: For multi-app traffic identification, they decompose the graph into multiple subgraphs by removing triggering and concurrent correlations first.

Nadia: This is then fed into a single-app classifier for those isolated components.

Elias: The efficiency metrics show a throughput of ten point five GB/s and a prediction latency of zero point six eight seconds with the compression module improving throughput by about twenty-five times.

Priya: A major design constraint is that MAppPrint is intended to be deployed before network address translation, or NAT, so adversaries can't separate traffic flows beforehand.

Nadia: This allows it to identify most multi-device traffic behind the NAT as multi-app traffic by clustering the separated flows.

Elias: It separates flows from different devices by clustering and then identifies the specific applications present in those clusters.

Lucky paper: 2610.22301: Nadia: So we're looking at My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale today.

Elias: This paper dives into how the Model Context Protocol standardizes AI agents invoking external tools and where that creates a security hole with filesystem capability laundering.

Priya: It outlines three conditions for this laundering: the effect exceeds the tool contract, attacker-influenced arguments select the target, and surrounding controls fail to constrain it.

Nadia: The research analyzes this across three layers: server-category screening at layer one, per-tool contract analysis at layer two, and path validation checks at layer three.

Elias: They focus on local stdio MCP servers running with the user’s ambient filesystem permissions while the client's tool approval prompt has no per-tool path restrictions.

Priya: An attack succeeds when the response from the MCP server contains file contents outside of what that specific tool is supposed to access.

Nadia: The authors designed a defense called MCP-FSD, which catalogs servers and discovers tools inside sandboxes with static filters.

Elias: This framework runs in two passes: a measurement pass crawls registries to assign capability triage labels and a validation pass applies static screening.

Priya: The static screening phase uses an LLM to classify tool registrations into five rule categories spanning CWE-twenty-two path traversal and CWE-fifty-nine link resolution.

Nadia: They look at specific issues like PT-one missing validation or PT-four symlink TOCTOU within those classifications.

Elias: For example, they saw a git add handler connecting the schema’s files parameter to repo index add without a repository containment check, which they labeled as a PT-one SARIF candidate.

Priya: The boundary inference algorithm constructs a policy hypothesis using four signals: launch configuration L, path-bearing schema fields S, tool description D, and repository source R.

Nadia: They extract roots from the launch tuple and use an LLM to suggest a candidate glob policy that covers runtime requirements identified in R.

Elias: After that they partition the result into a read-write and a read-only half to infer the least-privilege boundary for each tool.

Priya: The dynamic three-case validation confirms exploitability with three specific cases, testing if malicious payloads succeed without a sandbox, require no denial event with in-scope payloads, or need an explicit denial event otherwise.

Nadia: They cataloged twenty-one thousand ninety-seven listings from nine registries and found that dynamic validation confirmed one hundred fifty vulnerable instances under tested policies.

Elias: Out of those flagged servers, they saw seven hundred eighty-seven exhibit filesystem capability flags without a FileSystem category label during the initial layer one screening.

Priya: The L3 defense-bypass classifiers achieved ninety-five point three percent precision and ninety-nine point three percent recall across those labeled findings.

Nadia: They reported two CVEs in Anthropic’s Git MCP Server, which illustrates this laundering happening across distinct boundaries at layer two.

Elias: The conclusion is that ecosystem-scale registry screening and explicit, runtime-enforced per-tool filesystem contracts are necessary to bridge that gap.

Lucky paper: 2610.20907: Nadia: We're diving into From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection.

Elias: This paper looks at whether training models for calibrated outputs guarantees reliable security decisions when you have a distribution shift in attacks.

Priya: They compared three detection models: Jev, Prompt Guard two with different parameter sizes, and an LLM judge across forty-seven thousand six hundred eleven held-out examples.

Nadia: The LLM judge achieved the highest overall discrimination score of zero point eight nine seven in this study.

Elias: But Jev’s native probabilities aren't consistently better calibrated than temperature-scaled classifier scores under calibration metrics.

Priya: Jev shows an ECE of zero point five four one, while the calibrated Prompt Guard two with eighty-six million parameters hits an ECE of zero point five seven one in the same evaluation set.

Nadia: Temperature scaling substantially improves those Prompt Guard calibration metrics, especially the negative log likelihood score which drops from one point four three to one point one zero four.

Elias: The research also looks at how uncertainty at the gate translates into ALLOW, BLOCK, or DEFER decisions when paired with a frozen imperfect reviewer.

Priya: They found that the empirical confirmatory escalation rate needed to keep false negative rate less than one percent is over ninety-one point eight percent for PG2-86M and ninety-two point four five percent for PG2-22M.

Nadia: That crossing point is just a descriptive test statistic, not a deployment threshold chosen using confirmatory labels.

Elias: The system false positive rate stays between forty point six and forty five point eight percent at those crossing points, which shows FNR alone isn't enough to characterize the resulting policy.

Priya: One key finding is that Jev misses sixty four point nine percent of attacks because its native zero point five decision boundary misses so many.

Nadia: The study concludes that discrimination, calibration, reviewer behavior, and policy utility all need to be evaluated together as part of the same pipeline.

Elias: They stress that calibration needs to be evaluated on the target workload rather than inferred from the model’s training objective.

Priya: The comparison also differs because Prompt Guard two is temperature-scaled on target calibration data, while Jev uses its native probability distribution.

Nadia: The cost model used in evaluation is illustrative, and deployment policies should instead be selected using application-specific costs and review budgets.