Daily Summary for 2026-10-22

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: It's the twenty-second of October, twenty twenty-six, and this is the day's research.

Elias: 11 new papers came out today.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We'll take the day in one pass, then pull out the papers we're staying with.

Elias: Start us off with Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals.

The summary: Nadia: Welcome listeners. It is the twenty-second of October, twenty twenty six.

Elias: We worked on protecting large language models from intellectual property theft today.

Priya: The focus was building defenses against adversaries making copies by training surrogate versions of these models.

Nadia: This causes financial harm to the original creators.

Elias: A key research piece is SAFESEAL, a new way to watermark proprietary language models while keeping them useful for users.

Priya: It works by replacing words with context-aware synonyms using a key-conditioned tournament sampling mechanism.

Nadia: This preserves meaning while making copying more difficult.

Elias: Experiments showed SAFESEAL keeps high utility, achieving a BERTScore of 0.983 and an entity similarity of 0.963.

Priya: It also shows strong detectability with a ninety eight point two percent detection rate against baselines like AKMPC.

Nadia: The framework includes a key-conditioned contrastive detector for provider-specific and robust watermark verification.

Elias: Testing latency is comparable to the fastest baseline in its tests.

Priya: Agreed. It shows strong detectability and good utility metrics with SAFESEAL.

Nadia: Memory in LLM agents can cause unexpected behavior through memory-induced tool-drift.

Elias: That means stored personality preferences silently change tool calls despite context.

Priya: MEMDRIFT tested this, showing biased memories degrade parameters significantly.

Nadia: Drift rates reached 0.83 in some cases versus lower rates for neutral memories.

Elias: It suggests filtering prompts is insufficient to control how stored knowledge directs actions.

Priya: Moving to security, an AI agent monitors University ACMIS infrastructure layers effectively.

Nadia: This agent achieved a threat detection macro-average F1 of 0.966 against logs.

Elias: It uses behavioral analytics and NLP to respond to potential attacks quickly.

Priya: The single-node prototype showed very low latency for critical responses in the system.

Nadia: That is one way memory affects agent actions through drift.

Elias: And this security research shows advanced threats can bypass standard detection methods.

Priya: The ACMIS agent's performance against simulated logs was quite high at 0.966 F1.

Nadia: Its ability to respond with low latency on a single node is notable for critical events.

Elias: So, we see failures in memory control and successes in layered infrastructure security then.

Nadia: Physical domain research focuses on securing autonomous systems from hidden malware in sensors like LiDAR.

Elias: That work shows dormant code can activate remotely using sensor signal processing as a covert channel.

Priya: So it proves triggering malware even when it is not active during normal operation.

Nadia: Indeed, and in automotive control systems, they are stopping timing side-channel attacks on CAN buses.

Elias: They do this by skipping control task executions and randomly shifting task instances to prevent bus-off attacks.

Priya: That strategy shows reducing attack chances lowers security overhead without harming performance or safety guarantees.

Nadia: It demonstrates a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing overhead.

Elias: Which is exactly what Skip to Secure provides for securing cyber-physical control loops.

Priya: This links the concept of skipping executions directly to mitigating stealthy attacks in those networks.

Nadia: Today's papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity.

Elias: Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals is worth hearing as it identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals.

Priya: An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response is useful because it monitors various layers of a university management system to detect and automatically respond to security threats.

Nadia: Memory-Induced Tool-Drift in LLM Agents is relevant because it studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context.

Elias: Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks is important as it proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions.

Priya: That paper is worth hearing because it hides timing information in CAN bus traffic through task execution manipulation.

Nadia: Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions is valuable for providing a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Elias: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Priya: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: Agreed. The episode is now over. Today's lucky papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity, Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals, An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response presents an AI agent that monitors various layers of a university management system to detect and automatically respond to security threats, Memory-Induced Tool-Drift in LLM Agents studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context, Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions, and Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: That is the end of the review.

Lucky paper: 2606.17562: Nadia: Let's look at this paper now. It's Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals from Duke University.

Elias: The paper shows how dormant malware embedded in LiDAR firmware can be remotely activated after deployment using a brief modulated optical signal.

Priya: They identify this as an attack surface where the malware remains inactive during normal operation but can be triggered externally without needing network access or sustained attacker interaction.

Nadia: So the trigger mechanism relies on exploiting native dual-return sensing and low-level filtering functionality already inside the LiDAR sensor itself.

Elias: The trigger involves the attacker emitting a transmitted optical sequence, which the victim LiDAR extracts timing-derived symbols via its native signal processing.

Priya: The malware then assembles those symbols into a reconstructed message and compares it against target messages stored within it to select an attack mode.

Nadia: Feasibility experiments showed this works across different conditions, like static scenes at three hundred ft and mobile sensor drive-by runs reaching at least thirty-five mph.

Elias: They also demonstrated successful triggering using both direct illumination and reflected delivery paths, such as wall and ceiling reflections.

Priya: The study evaluated whether injected person-like artifacts remain semantically detectable under a tuned LiDAR three dee detector, specifically FCAFthree dee thirty-five.

Nadia: The results showed that these injected artifacts can still be detected by the detector, which supports the plausibility of perception-level manipulation.

Elias: Furthermore, attacks on a deployed tactical autonomous vehicle demonstrated multiple modes of safety-critical impact.

Priya: This includes emergency stops from induced sensor error and mission aborts from false data injection on a tactical autonomous vehicle.

Nadia: The implications are that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines.

Elias: Mitigation priorities suggest focusing first on secure boot and firmware signing for sensor integrity, followed by runtime attestation to verify sensor state.

Priya: Downstream consistency checks should be treated as secondary mitigations rather than primary ones against this type of attack.

Nadia: The conclusion is that dormant malware in the LiDAR sensing pipeline can be remotely activated after deployment using a brief modulated optical signal without requiring network access or sustained attacker interaction during execution.

Lucky paper: 2606.08252: Nadia: We're moving on to a paper that tackles a hidden privacy risk in federated learning, Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning.

Elias: It analyzes how semi-honest servers can learn private models from the logits during training.

Priya: They introduce the Adaptive Model Stealing Attack, or AdaMSA, to quantify this risk by looking at historical logits during training.

Nadia: How does that attack actually work in practice?

Elias: The attack formulates the target logit as pˆT equal to sum t from T minus T0 t Z times p t where T0 is a threshold governing past predictions, and Z is a normalization factor.

Priya: Then the attacker minimizes the LCE between that target logit and their own model's logits using gradient descent to train an attacking model ˜theta.

Nadia: So they are trying to approximate the private model's intermediate training states from prior iterations.

Elias: Exactly, and they quantify the privacy risk R by evaluating the accuracy of a model f with parameters ˜theta on a victim’s private test dataset Dk.

Priya: The theoretical analysis establishes bounds for this risk in logit-based FL methods using an empirical risk expression epsilonDmix equals alpha times epsilonDpr iv plus one minus alpha times epsilonDpub.

Nadia: What does that formula actually mean for the privacy guarantee?

Elias: Theorem three point four bounds the difference between the empirical risks of the mixed dataset and the private dataset by a quantity involving alpha, epsilonDpr iv, epsilonDpub, and a lambda term.

Priya: That bound drops to zero as alpha increases to one.

Nadia: So increasing alpha means you increase utility at the cost of increasing privacy risk based on that formula.

Elias: The defense they propose is Federated Logit Perturbation, or FedLP, which perturbs the transmitted logits of local models.

Priya: The defender tries to prevent an adversary from replicating the functionality of its private model by bounding the perturbation scale by a non-negative constant gamma.

Nadia: How does FedLP actually implement that perturbation when it's optimizing that constrained problem?

Elias: The defense problem is reformulated as a constrained optimization problem to maximize maxp′ G(thetaT minus one p prime) minus G(thetaT minus one p) subject to the constraint that the difference between the original logit and the perturbed logit is less than or equal to gamma.

Priya: A simple heuristic solver perturbs a logit by setting p prime equal to p plus Z times ej where ej is a one-hot vector.

Nadia: So they are using this specific perturbation method to try and keep the privacy guarantee intact when the server is semi-honest.

Elias: The paper shows that this perturbation based defense strategy preserves epsilon, delta D P if and only if gamma is greater than or equal to 2ln(one point two five over delta times Delta squared epsilon) squared.

Priya: They also show that the composition property of RDP algorithms ensures the ensemble result computed using those perturbed outputs remains alpha, ik i equals one delta-Rényi differentially private for any alpha greater than or equal to max i alpha i.

Nadia: Experimentally, they tested AdaMSA and FedLP in three settings: Close-world, Open-world-CF, and Open-world-TI.

Elias: The results show that AdaMSA demonstrates significant improvements of up to four point zero zero percent in the close world setting, three point four one percent in open world CF, and three point one one percent in open world TI settings compared to MSA and naïve AdaMSA baselines.

Priya: Furthermore, their proposed FedLP defense is closest to the ideal trade-off curve, indicating it achieves a better utility and privacy trade-off compared to state-of-the-art baselines.

Nadia: They also observed that increasing the value of alpha means decreasing the distance between logits increases utility at the cost of increasing privacy risk based on their empirical findings.

Elias: And when T0 increases from zero to three they observed that attack performance gradually increases by two point eight seven percent in Open-world-CF setting and two point four five percent in Open-world-TI setting.

Priya: Finally, the conclusion states that this work provides the first theoretical and empirical analysis of a hidden privacy risk where semi-honest servers can infer clients’ private models according to logits.

Lucky paper: 2605.02557: Nadia: We're moving into number three of five with VertMark, a unified training-free robust watermarking framework for Vertical Domain Pre-trained Language Models.

Elias: This paper tackles the problem of how to keep copyright identifiers stable when models are stolen, attacked, and then fine-tuned for different downstream tasks.

Priya: VertMark proposes this system using hidden semantic-equivalence mappings between low-frequency trigger tokens and high-frequency domain-relevant tokens.

Nadia: So the model owner embeds ownership information into a vertically pre-trained language model and then deploys it through an ML as a Service platform.

Elias: The main challenge is that an attacker might steal the watermarked model, say theta s, and then apply operations like pruning or quantization to get an attacked version theta's.

Priya: VertMark has three modules: trigger-replacement token construction, watermark embedding, and watermark verification.

Nadia: For the construction module, they select low-frequency tokens from the training corpus based on their token frequency statistics to form a candidate trigger set D t.

Elias: Then they generate indices using RSA encryption and SHA256 hashing based on that set to select the final trigger set T.

Priya: Each trigger token in T gets paired with a replacement token in the replacement set R, forming a semantic equivalence mapping = (t i, r i).

Nadia: The embedding module is unique because it bypasses gradient-based training entirely and directly replaces the word embedding of each trigger token with that of its corresponding replacement token.

Elias: They add a linear scaling factor lambda and Gaussian noise N(mu, sigma two) during this replacement process to keep it stealthy.

Priya: This means the expected value of the word embedding for the trigger token t i is equal to one lambda times the expected value of the replacement token r i plus some noise.

Nadia: The paper notes that parameter updates during downstream task fine-tuning concentrate mainly in deeper transformer layers, while shallow word embedding layers usually change only slightly.

Elias: That’s why they think adding Gaussian noise and a linear transformation during replacement is key to keeping the watermark hidden.

Priya: The verification module works by creating two variants for every input sample: one with the replacement token r i and another where r i is replaced back with its trigger token t i.

Nadia: The owner queries a suspicious API with both variants, and if the outputs remain consistent at the task-semantic level, it confirms the watermark verification.

Elias: They use different strategies for Natural Language Understanding NLU versus Natural Language Generation NLG tasks to support those different requirements.

Priya: For NLU tasks, they introduce a sensitivity-based sample filtering mechanism to find samples that are inherently insensitive to token-level semantic changes.

Nadia: And for NLG tasks, they use a cosine similarity based strategy measuring the similarity between generated outputs using the all-MiniLM-L6-v2 model.

Elias: Regarding robustness, VertMark shows strong resistance against pruning attacks when low pruning rates are used because only PTLayer showed noticeable degradation in the financial domain.

Priya: Even under high pruning rates, VertMark maintains a relatively high WACC in NLU tasks and outperforms baselines specifically in NLG tasks.

Nadia: Against INT8 quantization, all methods maintain relatively high WACC, which suggests that low-bit quantization has limited impact on watermark detection across the board.

Elias: The study also shows that against model extraction attacks simulated by knowledge distillation using a 2GB general-domain corpus, VertMark's WACC exceeds seventy percent after five training epochs in the medical domain.

Priya: And against backdoor watermark removal attacks via model fusion, the attack degrades downstream performance and significantly weakens detection for baseline methods, dropping WACC to near zero.

Nadia: The ablation studies on hyperparameters show that the scaling coefficient lambda mainly affects WACC but has little influence on downstream task performance or the average L2 distance.

Elias: They found that a value of lambda = one point five achieves the most balanced performance across tasks and domains, so they set it as the default setting.

Priya: For the noise distribution parameters, mu and sigma squared, they found little effect on downstream task performance but mainly control stealthiness and WACC.

Nadia: They adopted (mu, sigma squared) = (zero point one, zero point zero one) as the default configuration for balancing effectiveness and concealment.

Elias: Finally, for the trigger-token frequency f, it has little effect on downstream task performance but substantially affects WACC, so they chose low-frequency tokens between zero point zero zero one percent to zero point zero one percent.

Priya: VertMark concludes that it offers a unified and efficient solution for copyright verification of VPLMs because it eliminates the need for additional training by directly injecting ownership watermarks into the word embedding layer through parameter replacement.

Lucky paper: 2504.21752: Nadia: We're talking about VDDP today, Verifiable Distributed Differential Privacy under the Client-Server-Verifier Setup.

Elias: The authors are Haochen Sun and Xi He from the Cheriton School of Computer Science at the University of Waterloo.

Priya: This research introduces a framework called VDDP to handle malicious behavior in distributed differential privacy mechanisms operating in a client-server-verifier setup.

Nadia: They formalize this using an Interactive Distributed Proof of Differential Privacy, or I2DP protocol.

Elias: The key innovation is randomness disentanglement, RD, which resolves server collusion challenges by distributing randomness generation between the verifier and the servers using a public coin private coin model.

Priya: To get to (tau, epsilon)-verifiable distributed differential privacy VDDP, they require three things: the underlying server functions must be (tau, epsilon(kappa), delta(kappa))-DDP, commitment schemes must be hiding, and all sub-protocols need to be zero-knowledge.

Nadia: So ZKPs aren't strictly necessary for this level of security assurance within the VDDP framework.

Elias: They developed three efficient instantiations: the Verifiable Distributed Discrete Laplace Mechanism, or VDDLM; the Verifiable Distributed Discrete Gaussian Mechanism, or VDDGM; and an Improved Verifiable Randomized Response, or VRR under Local DP.

Priya: The VDDLM instantiation is quite impressive because it achieves up to a four hundred thousand times improvement in proof generation efficiency compared to previous state-of-the-art verifiable differentially private mechanisms.

Nadia: That speedup is substantial, and they also included a tight privacy analysis that accounts for numerical imprecisions from fixed-point arithmetic and truncation.

Elias: They also showed that VDDLM remains (nSer-one epsilon, delta)-DDP when at least one server is fully honest.

Priya: The communication cost reduction with the VRR solution is even better, achieving up to a five thousand times reduction in communication costs and verifier overhead compared to prior solutions.

Nadia: That five thousand times reduction in communication cost is significant for real-world deployment scenarios.

Elias: The empirical evidence supports these claims with proof generation speeds that are up to four million three hundred twenty thousand times faster in VDDLM compared to VDBM under equivalent privacy costs.

Priya: For large problem dimensions like one thousand twenty-four and small privacy budgets such as epsilon=ten-three the server's running time improves by four times 1e5 and the verifier's time improves by three times 1e7.

Nadia: That shows a significant reduction in server and verifier running times for those specific parameters.

Elias: The paper also provides an explicit expression for the expected L1 error in the modified discrete Laplace mechanism, linking it to parameters derived from the discrete Laplace noise distribution.

Priya: The VRR solution achieves zero-completeness and (zero epsilon)-VDDP when zero-knowledge subroutines are included according to Theorem five point three.

Nadia: The open questions they raised are about instantiations of VDDP that utilize non-zero-knowledge proofs while achieving asymptotic overhead reduction, and alternative sampling methods for the discrete Gaussian mechanism compatible with existing or novel proof protocols.

Elias: That means future work needs to explore those non-zero-knowledge proof options and new sampling methods for the Gaussian mechanism.

Priya: So VDDP shows that verifiable distributed differential privacy can be achieved efficiently even without strictly needing zero-knowledge proofs for end-to-end guarantees.

Lucky paper: 2007.08121: Nadia: Let's look at Skip to Secure today, which is paper number five of five in this show.

Elias: This paper tackles securing cyber-physical control loops by using intentional skipping of control loop executions as a control-theoretic countermeasure against stealthy attacks that violate message integrity and authenticity.

Priya: The core problem is that increased network connectivity creates more attack surfaces, and false data injection can disturb closed loop stability.

Nadia: Standard security primitives like MACs or encryption are often limited by the compute resources available on those on-board platforms in these systems.

Elias: The proposed approach synthesizes control skipping patterns from a CPS specification to maximize attack resilience without compromising the desired control performance of the system.

Priya: They use a two-step optimization framework where first they synthesize patterns ranked by their control performance, and then they analyze attack resilience using Satisfiability Modulo Theory, or SMT, based techniques.

Nadia: The physical plant is modeled as a linear discrete-time invariant system with the augmented state equation being X

k + one: = A1 Xk.

Elias: If you intentionally skip the controller execution inside a sampling interval from k to k plus one no new control update is sent to the plant and state estimation unit during that instance.

Priya: A control skipping pattern is defined as an l-length pattern for a given control loop P,K, which can be repeated with period l across an infinite length schedule pi = rho k.

Nadia: The design metric they use to measure performance is settling time, and the Quality of Control or QoC is defined by the LQR cost function J = sum k=zero infinity (xT

k: Qx

k: + uT

k: Ru

k: ).

Elias: A control skipping pattern must have at least l times r number of ones to maintain the required settling time Ts.

Priya: The attacker aims to alter the operating point by injecting an attack vector Ad, which is defined as Ad = A

one: d: = u one times... times u d.

Nadia: The attack is considered stealthy if ri T h for all indices i from k plus one to k plus d plus nup.

Elias: It is successful if there exists some index j between k plus one and k plus d plus nup such that xj is less than C2.

Priya: The paper presents the first work motivating the use of intentional execution skips as a control-theoretic security measure, along with an SMT based algorithmic framework for synthesizing successful but stealthy false data injection attack vectors.

Nadia: They also design sporadic intrusion detection systems that have increased down-time or more attack resilience when compared to existing sporadic IDS schemes that use period control implementations.

Elias: They use a measure of non-uniformity called LQR-Distance to rank patterns with the same number of execution skips based on their control performance, and this process results in a final set Pl where all patterns are sorted in increasing order of LQR-Distance.

Priya: Case studies on the Vehicle Dynamic Controller and Trajectory Tracking Controller demonstrate the efficacy, showing that for TTC running with l = ten the most attack resilient pattern is rho = one billion ten million eleven thousand one hundred eleven with an IDS rate of zero point two three zero seven.

Nadia: For the VDC, their methodology showed a reduction in IDS rate of about thirty-seven point five percent when compared to existing methods.

Elias: The conclusion is that control skipping patterns can be synthesized guaranteeing desired performance with increased resilience, and this helps reduce computation and communication overhead for sporadic IDS schemes in Automotive CPS.

Priya: This work builds on the ideas from Skip to Secure by integrating SMT-based techniques with safe but approximate analysis to increase the scalability of this approach for complex industrial test cases.