Daily Summary for 2026-10-22

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: It's the twenty-second of October, twenty twenty-six, and this is the day's research.

Elias: 7 new papers came out today.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We'll take the day in one pass, then pull out the papers we're staying with.

Elias: Start us off with Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals.

The summary: Nadia: Welcome listeners. It is the twenty-second of October, twenty twenty six.

Elias: We worked on protecting large language models from intellectual property theft today.

Priya: The focus was building defenses against adversaries making copies by training surrogate versions of these models.

Nadia: This causes financial harm to the original creators.

Elias: A key research piece is SAFESEAL, a new way to watermark proprietary language models while keeping them useful for users.

Priya: It works by replacing words with context-aware synonyms using a key-conditioned tournament sampling mechanism.

Nadia: This preserves meaning while making copying more difficult.

Elias: Experiments showed SAFESEAL keeps high utility, achieving a BERTScore of 0.983 and an entity similarity of 0.963.

Priya: It also shows strong detectability with a ninety eight point two percent detection rate against baselines like AKMPC.

Nadia: The framework includes a key-conditioned contrastive detector for provider-specific and robust watermark verification.

Elias: Testing latency is comparable to the fastest baseline in its tests.

Priya: Agreed. It shows strong detectability and good utility metrics with SAFESEAL.

Nadia: Memory in LLM agents can cause unexpected behavior through memory-induced tool-drift.

Elias: That means stored personality preferences silently change tool calls despite context.

Priya: MEMDRIFT tested this, showing biased memories degrade parameters significantly.

Nadia: Drift rates reached 0.83 in some cases versus lower rates for neutral memories.

Elias: It suggests filtering prompts is insufficient to control how stored knowledge directs actions.

Priya: Moving to security, an AI agent monitors University ACMIS infrastructure layers effectively.

Nadia: This agent achieved a threat detection macro-average F1 of 0.966 against logs.

Elias: It uses behavioral analytics and NLP to respond to potential attacks quickly.

Priya: The single-node prototype showed very low latency for critical responses in the system.

Nadia: That is one way memory affects agent actions through drift.

Elias: And this security research shows advanced threats can bypass standard detection methods.

Priya: The ACMIS agent's performance against simulated logs was quite high at 0.966 F1.

Nadia: Its ability to respond with low latency on a single node is notable for critical events.

Elias: So, we see failures in memory control and successes in layered infrastructure security then.

Nadia: Physical domain research focuses on securing autonomous systems from hidden malware in sensors like LiDAR.

Elias: That work shows dormant code can activate remotely using sensor signal processing as a covert channel.

Priya: So it proves triggering malware even when it is not active during normal operation.

Nadia: Indeed, and in automotive control systems, they are stopping timing side-channel attacks on CAN buses.

Elias: They do this by skipping control task executions and randomly shifting task instances to prevent bus-off attacks.

Priya: That strategy shows reducing attack chances lowers security overhead without harming performance or safety guarantees.

Nadia: It demonstrates a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing overhead.

Elias: Which is exactly what Skip to Secure provides for securing cyber-physical control loops.

Priya: This links the concept of skipping executions directly to mitigating stealthy attacks in those networks.

Nadia: Today's papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity.

Elias: Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals is worth hearing as it identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals.

Priya: An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response is useful because it monitors various layers of a university management system to detect and automatically respond to security threats.

Nadia: Memory-Induced Tool-Drift in LLM Agents is relevant because it studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context.

Elias: Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks is important as it proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions.

Priya: That paper is worth hearing because it hides timing information in CAN bus traffic through task execution manipulation.

Nadia: Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions is valuable for providing a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Elias: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Priya: That paper is worth hearing because it provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: Agreed. The episode is now over. Today's lucky papers are Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection because it balances strong detectability and minimal impact on model utility while preserving semantic fidelity, Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals identifies a way to trigger dormant malware in LiDAR sensors remotely using modulated optical signals, An AI Security Agent for University ACMIS Multi-Vector Threat Detection and Automated Response presents an AI agent that monitors various layers of a university management system to detect and automatically respond to security threats, Memory-Induced Tool-Drift in LLM Agents studies how stored personality preferences in memory can cause LLM agents to incorrectly change their tool usage based on context, Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks proposes a method to hide timing information in CAN bus traffic by skipping and randomly shifting control task executions, and Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions provides a principled way to intentionally skip control loop executions as a countermeasure against stealthy attacks while reducing security overhead.

Nadia: That is the end of the review.

Lucky paper: 2606.17562: Nadia: Welcome back to the show with us, Elias and Priya. Today we are looking at a paper titled Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals from Duke University.

Elias: This research looks at a really specific risk in autonomous systems—how dormant malware embedded in LiDAR firmware can be remotely activated after deployment without needing network access or sustained interaction during the attack.

Priya: The authors identified that LiDAR sensors are complex cyber-physical systems where vulnerabilities exist across optical, electronic, and software components from distributed vendors.

Nadia: So because of those multiple implantation paths—manufacturing insertion, compromised updates—there's a gap in understanding how a compromised sensor could manipulate the LiDAR output.

Elias: The authors focused on physical-channel triggers as the most viable activation mechanism because it uses signals delivered over the same medium used by the LiDAR itself.

Priya: Specifically, they propose modulated signal activation, which exploits native dual-return sensing and related low-level monitoring functionality already built into the sensor.

Nadia: The trigger mechanism involves an attacker emitting a transmitted optical sequence, and the victim LiDAR extracts timing-derived symbols using its own signal processing to reconstruct a message.

Elias: Then the malware compares that reconstructed message against target messages embedded within it, and activation happens when a match satisfies the trigger condition.

Priya: The feasibility experiments covered diverse geometry and range conditions; they saw successful triggering with both direct illumination and reflected delivery paths.

Nadia: They demonstrated on-demand activation in indoor static scenes at approximately one hundred fifty ft via wall and ceiling reflection, as well as outdoor static conditions at three hundred ft standoff distances.

Elias: And the mobile sensor drive-by runs reached speeds of at least thirty-five mph while still achieving that remote activation.

Priya: They also evaluated semantic detectability; they fine-tuned a state-of-the-art three dee object detector, FCAFthree dee thirty-five, on a custom person dataset and applied it to the manipulated point clouds.

Nadia: The results showed that injected person-like artifacts can remain detectable under that tuned three dee detector, which supports the plausibility of perception-level manipulation.

Elias: Furthermore, attacks on a tactical autonomous vehicle demonstrated multiple modes of safety-critical impact, including emergency stops from sensor error induction and mission aborts from false data injection.

Priya: The implications are that sensor-internal compromise challenges the usual trust boundary in autonomous sensing pipelines because the trigger is transient and doesn't directly manipulate perception until it's inside the pipeline.

Nadia: Mitigation priorities suggest focusing first on sensor integrity through secure boot and firmware signing, followed by runtime attestation to verify sensor state, treating downstream consistency checks as secondary mitigations.

Elias: So, the main point of Anywhere, Any-Stymie is that securing autonomy requires stronger guarantees about the integrity of the sensing infrastructure itself.

Lucky paper: 2606.08252: Nadia: We're moving on to our second paper today, Quantifying and Defending against the Privacy Risk in Logit-based Federated Learning.

Elias: This research looks at a hidden privacy risk when using logit-based federated learning methods where a semi-honest server can learn clients’ private models from those logits during training.

Priya: They introduce an attack called Adaptive Model Stealing Attack, or AdaMSA, to quantify this risk by leveraging historical logits during training.

Nadia: So, AdaMSA adaptively steals the private model by approximating its intermediate training states from prior iterations using a target logit formulation of pˆT = sum t=T−T0 t Z · p t.

Elias: The normalization factor Z is defined as one over the integral k=T − T0 k, which ensures that the weights w t = one over Z sum to one.

Priya: The privacy risk R is then quantified by evaluating the accuracy of an attacking model f(x,˜theta) on the victim’s private test dataset Dk as R = E x∼Dk Acc f (x,˜theta).

Nadia: Theoretically, they establish bounds for this privacy risk in logit-based FL methods.

Elias: Theorem three point four bounds the difference between the empirical risks of the mixed dataset and the private dataset by epsilonDmix (theta) minus epsilonDpr iv (theta) less than or equal to (one - alpha) (one/two dHΔH (Dpr iv, Dpub) plus lambda), where lambda equals epsilonDpr iv (h*) plus epsilonDpub (h*).

Priya: That bound drops to zero as alpha increases up to one which is significant for the utility side.

Nadia: They then propose a defense strategy called Federated Logit Perturbation, or FedLP, which perturbs the transmitted logits of local models to defend against this privacy risk.

Elias: The defender aims to prevent an adversary from replicating its private model functionality while preserving training performance by bounding the perturbation scale by a non-negative constant gamma: p minus p′b less than or equal to gamma.

Priya: This defense problem gets reformulated as a constrained optimization problem to maximize maxp′ G(thetaT−one p′) minus G(thetaT−one p) subject to that constraint.

Nadia: A simple heuristic solver perturbs the logit by setting p′ equals p plus Z times e j, where e j denotes a one-hot vector with one in the j-th dimension of p and 0s elsewhere.

Elias: The privacy guarantee of FedLP is achieved if gamma is greater than or equal to 2ln(one point two five divided by delta times (Delta squared epsilon)) squared.

Priya: Furthermore, the composition property of RDP algorithms ensures that the ensemble result computed using those perturbed outputs remains (alpha, Ík i=one delta)-Rényi differentially private for any alpha greater than or equal to max i alpha i.

Nadia: Experimentally, they validated AdaMSA and FedLP in three settings: Close-world, Open-world-CF, and Open-world-TI.

Elias: The results show that AdaMSA demonstrates significant improvements of up to four point zero zero percent, three point four one percent, and three point one one percent in the respective settings compared to MSA thirty-six and Naïve AdaMSA baselines.

Priya: Moreover, our proposed FedLP defense is closest to the ideal trade-off curve because it achieves a better utility and privacy trade-off compared to state-of-the-art baselines.

Nadia: The results confirm that increasing the value of alpha, which means decreasing the distance between logits, will increase utility at the cost of increasing privacy risk.

Elias: Finally, they observed that when T0 increases from zero to three the attack performance gradually increases by two point eight seven percent in Open-world-CF setting and two point four five percent in Open-world-TI setting.

Priya: The results also show that AdaMSA can achieve similar accuracy of the victim models under different model hyperparameters.

Nadia: So, the conclusion is that this paper provides the first theoretical and empirical analysis of a hidden privacy risk in logit-based FL where a semi-honest server can infer clients’ private models according to logits.

Elias: The research introduces AdaMSA to quantify this risk and FedLP as a simple but effective perturbation-based defense strategy.

Lucky paper: 2605.24941: Nadia: We are looking at Mahavir Dabas, Jihyun Jeong, Ming Jin, and Ruoxi Jia's paper on Memory-Induced Tool-Drift in LLM Agents today.

Elias: This research formalizes the failure mode where personality biases leak into tool-call parameter selection when agents use long-term memory for personalization.

Priya: It argues that these biased memories act as implicit steering vectors, hijacking the model's attention mechanisms by creating lexical overlap between memory entries and tool schemas.

Nadia: So, how does this happen mechanically within the agent's operation?

Elias: The mechanism involves three steps: first, attention hijacking through lexical overlap; second, context suppression where task-relevant context gets pushed aside; and third, latent direction steering where attention shifts to the memory region.

Priya: This is particularly dangerous because it treats personal preferences from unrelated contexts as global behavioral directives for tool selection.

Nadia: The authors built a benchmark called MEMDRIFT to test this systematically across various scenarios and dimensions.

Elias: MEMDRIFT is a set of one hundred five synthetic professional tool-call scenarios covering five bias dimensions like cost consciousness and seven professional domains.

Priya: They also audited six thousand sixty-two tools across two hundred eighty-eight verified MCP servers to flag six hundred eight tools exhibiting parameters susceptible to this drift.

Nadia: The results show that biased memories raise deflection scores by up to +three point six points on a scale of one to five across frontier models.

Elias: That score is driven by multiple parameters being susceptible, and they found specific examples where a parameter like "visibility" in a GitLab project creation tool could shift from 'private' to 'public'.

Priya: The paper flags this as a High outcome delta because it transfers a personal preference into an inappropriate professional decision regarding data regulation.

Nadia: It also looked at how standard defenses, like prompt-based relevance instructions and memory filters, perform.

Elias: Those standard defenses successfully reduce the drift but they don't eliminate it entirely; a more aggressive filter achieves perfect performance in the controlled MEMDRIFT setting but fails to generalize in real-world scenarios.

Priya: The overall susceptibility score for these tools was four/five which is high because multiple parameters across different bias dimensions were flagged as vulnerable.

Nadia: So, the conclusion is that memory-induced tool-drift isn't just an artifact of one model or one bias; it’s a systematic failure mode inherent in memory-augmented agents as they get more consequential tools.

Elias: The critical point is that parameters encoding common personality trade-offs like cost or caution are silent vectors for drift, and this risk grows as agents interact with more critical tools.

Lucky paper: 2306.09206: Nadia: We’re moving on to paper number four of five which is Concealing CAN Message Sequences to Prevent Schedule-based Bus-off Attacks.

Elias: This paper tackles timing side channels in safety critical networks like Controller Area Networks by proposing a schedule obfuscation strategy called Hide-n-Seek.

Priya: The background explains that the deterministic timing of tasks exposes message transmissions, making the CAN bus a prime target for schedule based attacker type man in the middle attacks.

Nadia: So, they are looking at how task execution timing leaks information across a network protocol.

Elias: They propose an attack aware schedule obfuscation strategy called AAwSOS to hide that timing information from a schedule based attacker.

Priya: The methodology involves monitoring traffic over several CAN hyper periods and then deciding on specific obfuscation policies during the reconnaissance period.

Nadia: It uses three strategies for this, starting with Obf1, which is skipping victim task instances one by one in descending order of their corresponding ASP as long as the CLF property holds.

Elias: Then they have Obf2, which skips control tasks that are of higher priority than the victim task if Obf1 doesn't work.

Priya: And if neither of those works, they use Obf3, which dictates executing the victim task first among tasks with the same priority during subsequent reconnaissance periods.

Nadia: The attack success probability analysis mathematically establishes that AAwSOS significantly reduces the attack success probability compared to static schedules or other randomization techniques.

Elias: They show that P(ASObf) is approximately X times P(ASj Oq)P(Oq), which shows a clear reduction in risk.

Priya: The results specifically show that Obf1 is applied at execution instances where maximum ASPs are observed under a static task schedule, resulting in zero ASPs at those corresponding CAN transmission slots.

Nadia: This means any bus-off attack attempted during those specific periods gets detected immediately because the message isn't sent.

Elias: It incorporates a method to detect such attempts directly into the obfuscation framework.

Priya: The conclusion is that Hide-n-Seek reduces the bus-off attack success probability and includes a method to detect these attacks.

Nadia: This is how they reduce the vulnerability in real time safety critical cyber physical networks.

Lucky paper: 2007.08121: Nadia: Welcome back to our research roundup. Today we are looking at a paper that deals with securing cyber-physical control loops using intentional skipping of control loop executions.

Elias: We're discussing Skip to Secure, which focuses on using control theory to counter stealthy attacks in these systems.

Priya: The core problem is that increased connectivity creates more attack surfaces, and false data injection attacks can destabilize closed-loop systems by changing set points.

Nadia: Standard security like MACs or encryption often doesn't work well here because of the limited compute resources on on-board platforms.

Elias: This paper proposes a framework that synthesizes control skipping patterns automatically based on a system specification to maximize attack resilience without compromising performance.

Priya: It uses a two-step optimization framework where the first step ranks control skipping patterns by their settling time, and the second step analyzes attack resilience using Satisfiability Modulo Theory, or SMT.

Nadia: The paper describes a physical plant as a linear discrete-time invariant system with the augmented system equation being X

k + one: equals A1 Xk.

Elias: If you intentionally skip controller execution inside a sampling interval

k, k + one), no new control update goes to the plant, but sensor updates are still received. [Priya: A control skipping pattern is then defined as an l-length pattern that repeats with a period l. The design metric used is the settling time, or QoC, which is defined by the LQR cost function J equals Í infinity k=zero (xT

k: Qx

k: + uT

k: Ru

k: ).

Nadia: So, the goal is to find a pattern that has at least ⌈ l × rmin⌉ ones to maintain the settling time requirement Ts.

Elias: The attacker aims to alter the operating point of the system to drive it toward an unsafe state x less than C2 in the least amount of time possible while remaining stealthy.

Priya: An attack vector Ad is defined as A

one: d: equals △u1 · · · △ud, and it's deemed stealthy if ri is less than or equal to Th for all i in

k + one k + d + nup: .

Nadia: The framework synthesizes a set of patterns P ranked by control performance first, and then Step-two synthesizes the most attack resilient pattern set PR which is a subset of P.

Elias: They use a measure called LQR-Distance to rank patterns with the same number of execution skips based on their control performance for that ranking.

Priya: Case studies on the Vehicle Dynamic Controller and Trajectory Tracking Controller show real efficacy when applying this approach.

Nadia: For the Trajectory Tracking Controller, running their method with l equals ten they found that the most attack resilient pattern is ρ equals one billion ten million eleven thousand one hundred eleven which shows a twenty-seven point seven eight percent improvement over existing periodic IDS with a rate of zero point two three zero seven.

Elias: And for the Vehicle Dynamic Controller, their methodology resulted in about a thirty-seven point five percent reduction in the IDS rate when compared to prior methods.

Priya: The results show that even with deploying this pattern-based execution, system safety is maintained despite increasing the down-time of the IDS from two to five.

Nadia: That demonstrates how control skipping patterns can be synthesized guaranteeing desired performance with increased resilience, and it helps design sporadic IDS schemes based on intentional control loop skips which promises better resource utilization in terms of communication bandwidth.

Elias: It seems this work is a solid foundation for integrating SMT based techniques with safe but approximate analysis to increase the scalability of this approach for complex industrial test cases.