Daily Summary for 2026-10-22

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: It's the twenty-second of October, twenty twenty-six, and this is the day's research.

Elias: 10 new papers came out today.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We'll take the day in one pass, then pull out the papers we're staying with.

Elias: Start us off with Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals.

The summary: Nadia: Welcome listeners. It is the twenty-second of October, twenty twenty six.

Elias: We worked on protecting large language models from intellectual property theft today.

Priya: The focus was building defenses against adversaries making copies by training surrogate versions of these models.

Nadia: This causes financial harm to the original creators.

Elias: A key research piece is SAFESEAL, a new way to watermark proprietary language models while keeping them useful for users.

Priya: It works by replacing words with context-aware synonyms using a key-conditioned tournament sampling mechanism.

Nadia: This preserves meaning while making copying more difficult.

Elias: Experiments showed SAFESEAL keeps high utility, achieving a BERTScore of 0.983 and an entity similarity of 0.963.

Priya: It also shows strong detectability with a ninety eight point two percent detection rate against baselines like AKMPC.

Nadia: The framework includes a key-conditioned contrastive detector for provider-specific and robust watermark verification.

Elias: Testing latency is comparable to the fastest baseline in its tests.

Priya: Agreed. It shows strong detectability and good utility metrics with SAFESEAL.

Nadia: Memory in LLM agents can cause unexpected behavior through memory-induced tool-drift.

Elias: That means stored personality preferences silently change tool calls despite context.

Priya: MEMDRIFT tested this, showing biased memories degrade parameters significantly.

Nadia: Drift rates reached 0.83 in some cases versus lower rates for neutral memories.

Elias: It suggests filtering prompts is insufficient to control how stored knowledge directs actions.

Priya: Moving to security, an AI agent monitors University ACMIS infrastructure layers effectively.

Nadia: This agent achieved a threat detection macro-average F1 of 0.966 against logs.

Elias: It uses behavioral analytics and NLP to respond to potential attacks quickly.

Priya: The single-node prototype showed very low latency for critical responses in the system.

Nadia: That is one way memory affects agent actions through drift.

Elias: And this security research shows advanced threats can bypass standard detection methods.

Priya: The ACMIS agent's performance against simulated logs was quite high at 0.966 F1.

Nadia: Its ability to respond with low latency on a single node is notable for critical events.

Elias: So, we see failures in memory control and successes in layered infrastructure security then.

Nadia: Physical domain research focuses on securing autonomous systems from hidden malware in sensors like LiDAR.

Elias: That work shows dormant code can activate remotely using sensor signal processing as a covert channel.

Priya: So it proves triggering malware even when it is not active during normal operation.

Nadia: Indeed, and in automotive control systems, they are stopping timing side-channel attacks on CAN buses.

Elias: They do this by skipping control task executions and randomly shifting task instances to prevent bus-off attacks.

Priya: That strategy shows reducing attack chances lowers security overhead without harming performance or safety guarantees.

Nadia: It demonstrates a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing overhead.

Elias: Which is exactly what Skip to Secure provides for securing cyber-physical control loops.

Priya: This links the concept of skipping executions directly to mitigating stealthy attacks in those networks.

Nadia: Today's papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity.

Elias: Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals is worth hearing as it identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals.

Priya: An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response is useful because it monitors various layers of a university management system to detect and automatically respond to security threats.

Nadia: Memory-Induced Tool-Drift in LLM Agents is relevant because it studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context.

Elias: Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks is important as it proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions.

Priya: That paper is worth hearing because it hides timing information in CAN bus traffic through task execution manipulation.

Nadia: Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions is valuable for providing a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Elias: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Priya: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: Agreed. The episode is now over. Today's lucky papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity, Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals, An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response presents an AI agent that monitors various layers of a university management system to detect and automatically respond to security threats, Memory-Induced Tool-Drift in LLM Agents studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context, Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions, and Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: That is the end of the review.

Lucky paper: 2606.17562: Nadia: Okay, we are starting with Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals.

Elias: This paper looks at how dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal.

Priya: The authors show that this activation doesn't require any network access or sustained attacker interaction while the attack is running.

Nadia: So they are focusing on physical-channel triggers, which they say are the most viable mechanism because they use signals over the same medium already present in the LiDAR.

Elias: They propose a modulated signal activation that exploits native dual-return sensing along with related low-level monitoring and filtering functionality already built into the LiDAR.

Priya: The trigger involves an attacker emitting an optical sequence, which the victim LiDAR extracts as timing-derived symbols using its native signal processing capabilities.

Nadia: The malware then assembles those symbols into a reconstructed message and compares it against stored target messages embedded within the malware itself.

Elias: Activation happens when that match satisfies a specific trigger condition, which selects an attack mode and causes the malware to switch from just monitoring to actually executing behavior.

Priya: In their feasibility experiments, they tested this across different geometry, range, and victim-platform conditions.

Nadia: They showed successful triggering using both direct illumination and reflected delivery paths on things like walls and ceilings.

Elias: They demonstrated on-demand activation in indoor static scenes at approximately one hundred fifty ft using wall or ceiling reflections.

Priya: And they also tested it in outdoor static conditions at a three hundred ft standoff distance, as well as mobile sensor drive-by runs reaching at least thirty-five mph.

Nadia: They also looked at semantic detectability, seeing if the injected person-like artifacts could still be detected by a tuned LiDAR three dee detector, FCAFthree dee <ref:2606.17562#pg6>.

Elias: The results showed that these artifacts can remain detectable under that tuned detector, which supports the idea that perception-level manipulation is plausible.

Priya: Furthermore, they demonstrated multiple modes of safety-critical impact on a deployed tactical autonomous vehicle.

Nadia: This included emergency stops caused by sensor error induction and mission aborts resulting from false data injection.

Elias: The implications here suggest that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines, requiring stronger guarantees about the infrastructure's integrity.

Priya: Their mitigation priorities suggest focusing first on sensor integrity through secure boot and firmware signing, followed by runtime attestation to verify the sensor state.

Nadia: Downstream consistency checks should be treated as secondary mitigations rather than primary ones because they don't address the core issue inside the sensor.

Elias: So, this paper clearly shows that a sensor-internal compromise of LiDAR is a distinct and underexplored autonomy risk because dormant malware can be activated remotely without network access.

Lucky paper: 2605.02557: Nadia: Moving on to our next piece of research, we have VertMark: A Unified Training-Free Robust Watermarking Framework for Vertical Domain Pre-trained Language Models.

Elias: This paper tackles how to protect intellectual property in specialized language models across different domains.

Priya: The main challenge they are addressing is designing a watermarking framework that preserves copyright identifiers even when the model goes through complex infringement pipelines, like theft and subsequent fine-tuning.

Nadia: So, the core idea is embedding ownership information directly into a Vertical Pre-trained Language Model before it's deployed via an MLaaS platform.

Elias: The paper details how they use a training-free backdoor watermark approach to establish hidden semantic equivalence mappings between low-frequency trigger tokens and high-frequency domain-relevant tokens.

Priya: They construct these mappings by selecting trigger tokens from the domain training corpus based on their token frequency statistics, creating a set Dt.

Nadia: Then they use RSA encryption and SHA256 hashing to generate indices based on ownership identity to select the final trigger set T from Dt.

Elias: The embedding module then bypasses gradient-based training entirely by directly replacing the word embedding of each trigger token in the model's word embedding matrix with its corresponding replacement token.

Priya: They add linear scaling and Gaussian noise during this replacement process, aiming for stealthiness while maintaining semantic fidelity.

Nadia: The verification module works by creating two variants for every input sample, one with the replacement token and one with the original trigger token.

Elias: The owner queries a suspicious API with both variants and if the outputs stay consistent at the task-semantic level, it confirms the watermark is verified.

Priya: For Natural Language Understanding tasks, they use a sensitivity-based sample filtering mechanism to catch samples that are inherently insensitive to these token changes.

Nadia: And for Natural Language Generation tasks, they use a semantic similarity-based verification strategy measuring the cosine similarity between generated outputs using the all-MiniLM-L6-v2 model.

Elias: The robustness analysis shows strong performance against pruning attacks, where low pruning rates have limited impact on detection, except for PTLayer in the financial domain.

Priya: Under high pruning rates, VertMark still maintains a high WACC in Natural Language Understanding tasks and outperforms baselines in Natural Language Generation tasks.

Nadia: Against model quantization attacks, under INT8 quantization, all methods maintained relatively high WACC, showing that low-bit quantization has limited impact on detection.

Elias: The paper also tested against model extraction attacks simulated via knowledge distillation using a 2GB general-domain corpus and found that VertMark's WACC exceeded seventy percent after five training epochs in the medical domain.

Priya: Against backdoor watermark removal attacks from model fusion, the attack degrades downstream performance to varying degrees and significantly weakens detection for baseline methods, with WACC dropping to near zero.

Nadia: They analyzed the hyperparameters showing that scaling coefficient lambda mainly affects WACC but little downstream task performance, while lambda = one point five is the default setting they adopted.

Elias: The noise distribution parameters mu and sigma2 affect stealthiness and WACC more than downstream task performance, so (mu, sigma2) = (zero point one, zero point zero one) is the balanced configuration used by default.

Priya: And for the trigger-token frequency f, low-frequency tokens between zero point zero zero one percent and zero point zero one percent achieved a better balance among stability and robustness than higher frequencies which have little effect on performance but substantially affect WACC.

Nadia: So, VertMark gives a unified and efficient solution for copyright verification of VPLMs by injecting ownership-encoded watermarks directly into the word embedding layer without needing additional training.

Lucky paper: 2504.21752: Nadia: We are moving into our third paper of this show, and today we have VDDP: Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup from the Cheriton School of Computer Science at the University of Waterloo.

Elias: This paper tackles a big problem in distributed differential privacy mechanisms when multiple parties—clients, servers, and verifiers—might collude.

Priya: The core innovation is this Interactive Distributed Proof of Differential Privacy protocol that incorporates randomness disentanglement to resolve those server collusion challenges by distributing the task of randomness generation.

Nadia: So it's about making sure that even if the server tries to cheat, we still get verifiable differential privacy guarantees.

Elias: The paper formalizes this using an I2DP protocol and establishes (tau, epsilon) -verifiable distributed differential privacy by ensuring commitment schemes are hiding and all sub-protocols are zero-knowledge.

Priya: But they found that Zero-Knowledge Proofs aren't strictly necessary for this level of security assurance within the VDDP framework.

Nadia: That’s a key finding because it simplifies the protocol requirements compared to some other security models.

Elias: They developed three efficient instantiations, starting with the Verifiable Distributed Discrete Laplace Mechanism, or VDDLM.

Priya: VDDLM shows a remarkable up to four hundred thousand times improvement in proof generation efficiency compared to previous state-of-the-art verifiable differentially private mechanisms.

Nadia: That is a huge speedup for generating proofs in these distributed settings.

Elias: They also included a tight privacy analysis that specifically accounts for numerical imprecisions coming from fixed-point arithmetic and truncation errors.

Priya: And they show that the server function remains (nSer-one epsilon, delta) -DDP when at least one server is fully honest.

Nadia: That's important because it shows the mechanism holds up even under partial dishonesty from the servers.

Elias: They also have a Verifiable Distributed Discrete Gaussian Mechanism, or VDDGM, which extends VDDLM while incurring only limited overhead in real-world application scenarios.

Priya: And they also have an Improved Verifiable Randomized Response under Local DP, which is a special case of VDDP that achieves up to a five thousand times reduction in communication costs and verifier overhead.

Nadia: That massive reduction in communication cost for the VRR solution is very compelling for practical deployment.

Elias: The paper also quantifies this with empirical evidence showing that for large problem dimensions like one thousand twenty-four and small privacy budgets of epsilon=ten to three the server's running time improves by four times one hundred five and the verifier's by three times one hundred seven times.

Priya: The communication cost is reduced by a factor of four times one hundred seven in those same conditions, which is significant.

Nadia: It’s showing that the efficiency gains are substantial when you look at scaling up to large dimensions.

Elias: They also provided an explicit expression for the expected L1 error in the modified discrete Laplace mechanism, linking it directly to parameters derived from the discrete Laplace noise distribution.

Priya: So they give you a mathematical way to understand exactly how much privacy loss you are accepting due to those numerical errors.

Nadia: The paper concludes by pointing out two open questions for future research: one is about instantiations of VDDP that utilize non-zero-knowledge proofs while achieving asymptotic overhead reduction.

Elias: And the other is about alternative sampling methods for the discrete Gaussian mechanism that are compatible with existing or novel proof protocols.

Priya: It’s a solid piece of work because it rigorously constructs the framework and provides concrete, quantified efficiency improvements for distributed differential privacy systems.

Lucky paper: 2306.09206: Nadia: We're moving into our fourth paper of four today, and it’s called Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks.

Elias: This paper focuses on eliminating timing side channels in safety critical protocols like Controller Area Networks, or CAN.

Priya: It addresses how deterministic timing exposes information about task executions through message transmissions on the network buses, which is a major vulnerability for schedule based attacks.

Nadia: The paper proposes an attack aware schedule obfuscation strategy called Hide-n-Seek to hide this timing information from a schedule based attacker.

Elias: The methodology involves monitoring traffic over several CAN hyper periods and then choosing obfuscation policies based on that analysis.

Priya: They use three specific strategies: skipping the victim task instance, which is Obf1, or skipping higher priority tasks, which is Obf2.

Nadia: And the third strategy is executing the victim task first during subsequent reconnaissance periods if Obf1 and Obf2 don't apply.

Elias: The attack success probability analysis shows that this Hide-n-Seek approach significantly reduces the attack success probability when compared to static schedules or other randomization techniques.

Priya: Specifically, they use conditional probability to show that the overall ASP under Hide-n-Seek is substantially lower than what you'd see with a static schedule.

Nadia: The paper demonstrates that Obf1 is applied at execution instances where maximum ASPs are observed under a static task schedule, resulting in zero ASPs at their corresponding CAN transmission slots.

Elias: That means any bus-off attack attempted during those periods gets detected by the system.

Priya: The conclusion of Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks is that this lightweight algorithmic framework effectively reduces the bus-off attack success probability and includes a method to detect such attempts.

Nadia: So, we have seen how specific schedule transformations directly impact the risk of denial of service attacks in automotive networks.

Elias: It shows that by instrumenting an ECU schedule, you can protect safety critical messages without needing heavy cryptographic overhead.