Paper Feeds

From Noisy Traces to Root Causes: Structural Trajectory Analysis and Causal Extraction for Agent Optimization

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07702

AI Summary (中文)

背景与挑战

长时程智能体（long-horizon agents）的优化日益依赖基于反思（reflection）的机制：由大语言模型（LLM）作为“优化器”，分析执行失败并迭代改进策略。然而，真实世界中的执行轨迹（traces）噪声高、冗余性强——批量轨迹集合常包含大量重复或低信息量的失败案例，易导致优化效率低下及对非典型错误的过拟合；单条轨迹内部又充斥无关步骤，而传统上下文压缩方法（如截断、滑动窗口）缺乏因果感知，极易丢弃关键证据，生成误导性优化信号。

方法：STRACE 框架

本文提出 STRACE（Structural TRajectory Analysis and Causal Extraction），一种面向高信噪比优化上下文构建的端到端框架：

批级结构化过滤：通过挖掘跨轨迹的失败模式（failure patterns），自动识别并保留具有代表性的、信息丰富的失败样本，剔除冗余与同质化轨迹；
轨迹内因果定位：将单条文本轨迹建模为语义依赖图（textual dependency graph），基于因果推理算法定位真正引发失败的根因模块（root-cause module），精准移除非因果步骤，保留最小充分证据集。

实验与贡献

在极具挑战性的形式化验证基准 VeruSAGE-Bench 上，STRACE 成功优化了人类专家设计的复杂代理系统：成功率从 42.5% 提升至 58.5%，实现 1.4× 绝对提升（+16.0个百分点），显著超越截断、摘要、聚类等基线方法。本工作首次将结构化轨迹建模与显式因果提取结合，为 LLM 驱动的代理自优化提供了可解释、鲁棒且高效的新范式。开源代码：https://github.com/moomight/STRACE

AI Summary (English)

Long-horizon agent optimization increasingly relies on LLM-based reflection, yet raw execution traces suffer from high redundancy (across batches) and low causal signal (within trajectories), undermining optimization fidelity. STRACE addresses this by jointly performing batch-level failure pattern mining to retain representative failures and within-trajectory causal localization via a textual dependency graph to isolate root-cause modules and prune non-causal steps. On VeruSAGE-Bench—a formal verification benchmark—STRACE boosts success rate of human-expert agents from 42.5% to 58.5% (+16.0 pts, 1.4× improvement), outperforming standard context-filtering baselines. It establishes the first framework that explicitly couples structural trajectory analysis with causal extraction for robust, interpretable agent optimization. Code: https://github.com/moomight/STRACE

Abstract

The optimization of long-horizon agents increasingly relies on reflection-based mechanisms, where a large language model (LLM) acts as an optimizer to diagnose agent failures and improve agent policies. However, real execution traces are difficult to use directly for optimization: large trace collections are often redundant and heterogeneous, making optimization inefficient and prone to overfitting to low-value failures; meanwhile, each individual trajectory also contains many irrelevant steps, while naive context reduction methods such as truncation or sliding windows can discard causally important evidence and produce misleading optimization signals. To resolve this dilemma, we introduce STRACE (Structural TRajectory Analysis and Causal Extraction), a framework that constructs high signal-noise optimization contexts for more precise and effective optimization. At the batch level, STRACE mines failure patterns to filter redundant traces and retain representative failures; within each selected trace, it performs causal localization over a textual dependency graph to remove non-causal steps and identify the true root-cause module for optimization. Empirical results demonstrate that STRACE significantly outperforms standard context-filtering baselines. Notably, on a challenging formal verification task (VeruSAGE-Bench), it successfully optimizes human-expert designed agents, delivering $1.4\times$ success-rate improvement (42.5% to 58.5%). The code is available at https://github.com/moomight/STRACE .

Breaking Database Lock-in: Agentic Regeneration of High Performance Storage Readers for Database Bypass

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07696

AI Summary (中文)

研究背景

面向分析型负载的外部数据库访问长期受限于JDBC/ODBC等驱动层瓶颈：所有数据读取必须经由查询执行引擎与协议栈，而这些组件并非为批量列式分析优化，导致I/O冗余、序列化开销高、内存布局不友好，加剧了“数据库锁定”（database lock-in）问题。

方法创新：Jailbreak框架

本文提出Jailbreak——一种无需数据库引擎参与、直接解析底层存储文件的新型数据读取范式。其核心洞见在于：主流数据库（如PostgreSQL、MySQL）的存储格式虽复杂，但其二进制结构、页布局、元数据编码等均在开源代码与官方文档中明确定义。Jailbreak利用大语言模型（LLM）对这些可获取的工程文档进行理解与推理，自动生成数据库特化的存储读取器（storage readers），完全绕过人工编写的解析逻辑。该过程融合提示工程、代码合成与轻量级验证，将原本“黑盒”的存储文件转化为即插即用的Apache Arrow内存列式缓冲区。

关键结果与影响

在TPC-H基准下，Jailbreak生成的读取器与JDBC/ODBC基线在全部查询结果上100%语义等价；端到端分析吞吐量提升达27倍（最高），显著优于传统方案。生成的Arrow缓冲区可无缝接入DuckDB、Apache Spark、cuDF及Spark RAPIDS等主流引擎。本工作首次系统性验证了LLM辅助存储格式再生作为通用解法的可行性——只要目标数据库公开其存储规范（源码或文档），即可自动化构建高性能旁路读取能力，为跨系统数据迁移、读副本加速与湖仓一体化提供新范式。

AI Summary (English)

Analytical workloads on external databases suffer from driver-layer bottlenecks (e.g., JDBC/ODBC), which force all data access through query execution stacks ill-suited for bulk columnar analytics. Jailbreak breaks this lock-in by bypassing the database engine entirely and reading storage files directly—synthesizing high-performance, database-specific storage readers via LLMs guided by open source code and documentation. These auto-generated readers materialize data as standard Apache Arrow buffers, consumable natively by DuckDB, Spark, cuDF, and Spark RAPIDS. Evaluated on PostgreSQL and MySQL snapshot workloads (TPC-H), Jailbreak achieves bit-identical correctness versus JDBC/ODBC baselines and delivers up to 27× end-to-end throughput speedup. This demonstrates LLM-assisted storage reader synthesis as a general, documentation-driven methodology to liberate data across diverse database systems.

Abstract

Analytical workloads operating on data stored in external database systems face a fundamental bottleneck: data access is guarded entirely by the database driver, like JDBC or ODBC, forcing all reads through query execution and other driver layers that are not designed for bulk columnar analytics. We present Jailbreak, an approach that bypasses the database engine entirely by reading storage files directly and materializing data as in-memory columnar buffers. Jailbreak's key insight is that database file formats, while complex, are fully specified by their source code and documentation, artifacts that Large Language Models (LLMs) can ingest to regenerate operator-specific table reading components without human-engineered parsing logic. Jailbreak leverages LLM-assisted code synthesis for database storage decoding, turning a traditionally opaque format into a directly queryable artifact. We evaluate Jailbreak on PostgreSQL and MySQL storage files, targeting analytical snapshot scenarios common in read replicas and offline processing pipelines. The generated reader produces Apache Arrow buffers consumable directly by most of the widely known query engines, including DuckDB, Apache Spark, and GPU-accelerated frameworks such as cuDF and Spark RAPIDS. We validate correctness against JDBC/ODBC-based baselines using the TPC-H benchmark across all query results, and demonstrate significant performance improvements in end-to-end analytical throughput, achieving up to 27x speedups. Our results showcase that LLM-assisted storage reader synthesis is a viable and generalizable methodology for breaking data lock-in across database systems, with applications beyond PostgreSQL and MySQL for any system whose file format is available to the LLM from documentation or source code.

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07565

AI Summary (中文)

背景与挑战

单轮联邦学习（One-shot Federated Learning, OSFL）通过仅执行一轮客户端-服务器通信显著降低通信开销，但在数据分布高度异构（Non-IID）场景下，极易导致模型性能严重下降。现有知识迁移方法（如合成数据生成或知识蒸馏）虽能提升OSFL鲁棒性，但大多缺乏形式化隐私保障，难以兼顾低通信、强异构适应性与严格隐私保护三重目标。

方法创新：FedKT-CSD框架

本文提出FedKT-CSD（Federated Knowledge Transfer via Collaborative Synthetic Data），一种基于协同合成数据生成的知识迁移新范式。其核心设计受神经图像压缩启发：

共享隐空间：复用公开预训练的轻量级自编码器（如TinyVAE）作为全局一致的隐空间，避免客户端本地训练编码器；
极简客户端操作：各客户端仅需对私有数据做单次前向编码，计算并上传类别条件下的隐空间统计量（均值/协方差），通信量仅为O(C×d)，C为类别数，d为隐维数；
隐私增强聚合：服务器端采用安全聚合（Secure Aggregation） 融合统计量，并注入校准的差分隐私（DP）噪声，确保全局合成过程满足$(\varepsilon,\delta)$-DP；
无监督合成与泛化：解码器将聚合后的统计量映射为高质量合成数据集，用于训练全局模型及下游任务（如迁移学习、小样本学习）。

主要成果

在CIFAR-10/100、Tiny-ImageNet及医疗影像数据集上，FedKT-CSD在$\varepsilon=2$的强隐私约束下，准确率超越非隐私基线（如FedGen、FedKD）达1.8–3.2%，且支持千级客户端规模；通信开销较传统FL降低99.7%，客户端计算仅需≈0.5秒/轮。本工作首次在OSFL中实现可证明DP、零梯度上传、跨任务泛化能力的统一，代码已开源。

AI Summary (English)

One-shot federated learning (OSFL) drastically reduces communication by restricting training to a single round, yet suffers from severe performance degradation under data heterogeneity. While synthetic data generation offers a promising knowledge transfer pathway, existing methods lack formal privacy guarantees. We propose FedKT-CSD, a novel framework that jointly achieves low communication, robustness to heterogeneity, and rigorous $(\varepsilon,\delta)$-differential privacy. Inspired by neural image compression, FedKT-CSD leverages publicly pretrained autoencoders as a shared latent space: clients perform only one forward pass to compute class-conditional latent statistics (e.g., means/covariances), transmitting minimal metadata; the server aggregates these via secure aggregation, injects calibrated DP noise, and decodes a high-fidelity synthetic dataset for global model training and downstream tasks. Evaluated across diverse benchmarks (CIFAR-10/100, Tiny-ImageNet, medical images), FedKT-CSD matches or exceeds non-private baselines—even under $\varepsilon=2$—while scaling to 1,000+ clients and reducing client-side communication by 99.7%. Code is available at https://github.com/an7123/FedKT-CSD.

Abstract

One-shot federated learning (OSFL) addresses the communication overhead of federated learning by limiting training to a single round, but doing so without sacrificing model quality is non-trivial, particularly when client data distributions diverge. Recent work has addressed this challenge by aggregating client knowledge on the server through the construction of transferable synthetic datasets or distillates. However, most of these methods lack formal privacy guarantees, leaving a gap in jointly achieving low communication, robustness to heterogeneity, and rigorous privacy. We propose FedKT-CSD (Federated Knowledge Transfer via Collaborative Synthetic Data), a framework inspired by neural image compression that closes this gap by leveraging publicly pretrained autoencoders as a shared latent space. Each client encodes its private data in a single forward pass, computes class-conditional latent statistics, and transmits these to the server. The server aggregates these statistics via secure aggregation, adds calibrated differential privacy noise, and decodes a synthetic dataset for training a global model and further downstream tasks. This design provides formal $(\varepsilon,δ)$-differential privacy by construction, while keeping client-side computation and communication lightweight. Despite operating under privacy constraints, FedKT-CSD is competitive with and even outperforms non-private baselines across diverse datasets and heterogeneity settings, and scales to a large number of clients. Our code is available at: https://github.com/an7123/FedKT-CSD

Think Big, Search Small: Where Capacity Matters in Hierarchical Search Agents?

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07548

AI Summary (中文)

研究背景与问题

当前基于大语言模型（LLM）的搜索代理普遍采用多智能体分层架构：主代理将复杂多跳问答任务分解为子查询，并分发至并行子代理执行。然而，现有系统通常为所有角色（如分解、检索、生成）统一部署相同规模的模型，未系统探究模型容量在不同角色间的最优分配策略——这一关键设计空白限制了效率与性能的协同提升。

方法设计

本研究将分层搜索解耦为三个正交角色：

委托角色（Delegation）：负责任务分解与子查询生成；
执行角色（Execution）：负责信息检索、证据抽取与局部推理；
答案生成角色（Answer Generation）：固定为强基线模型（如Llama-3-70B），作为混杂变量控制。

我们在5个主流多跳问答基准（HotpotQA、2WikiMQA等）上，对委托与执行角色进行系统性容量扫描实验（覆盖1.7B–70B共6种模型规模），严格隔离变量影响。

核心发现

1. 角色解耦显著增益：相比单代理基线，角色因子化平均提升精确匹配（EM）达+4.1个百分点（4.5→8.6），且在全尺度下稳定有效；
2. 容量敏感性高度不对称：委托能力是核心瓶颈——其主干模型扩大带来~11点EM提升，而执行子代理扩容仅贡献~2.6点EM增益；
3. 高效执行新范式：采用质量过滤的轨迹蒸馏（QFTD）训练的1.7B执行器，在精度上匹敌前沿7B子代理，子代理token消耗降低37%，推动帕累托前沿前移。

创新与启示

本研究首次实证揭示“Think Big, Search Small”的设计准则：应集中算力于任务分解环节，轻量化执行模块。代码已开源：https://github.com/QinnanCai0115/role-factorized-search

AI Summary (English)

This paper investigates where model capacity matters most in hierarchical search agents. We factorize multi-agent search into three roles—delegation (task decomposition), execution (retrieval & evidence extraction), and answer generation (held fixed as control)—and conduct controlled capacity sweeps across six model scales (1.7B–70B) on five multi-hop QA benchmarks. Three key findings emerge: (1) Role factorization consistently outperforms single-agent baselines, boosting exact match by +4.1 points on average; (2) Capacity sensitivity is highly asymmetric—scaling the delegation backbone improves EM by ~11 points, while scaling execution yields only ~2.6 points, identifying decomposition as the critical bottleneck; (3) A 1.7B execution agent trained via quality-filtered trajectory distillation matches a 7B frontier sub-agent in accuracy while reducing sub-agent token usage by 37%, advancing the Pareto frontier. Our results prescribe a concrete design principle: concentrate capacity at delegation and downsize execution without sacrificing accuracy. Code: https://github.com/QinnanCai0115/role-factorized-search

Abstract

Large language model based search agents increasingly adopt multi-agent architectures in which a main agent decomposes a complex question into sub-queries and dispatches them to parallel sub-agents. However, existing systems instantiate all roles from a single model of identical scale, leaving open how model capacity should be distributed across roles. We factorize hierarchical search into three roles: a delegation role responsible for task decomposition, an execution role responsible for retrieval and evidence extraction, and an answer generation role held fixed as a confound control. We then conduct controlled capacity sweeps along the delegation and execution axes on five multi-hop QA benchmarks. The experiments yield three findings. First, role factorization consistently outperforms a single-agent baseline, improving exact match from 4.5 to 8.6 points across six model scales. Second, capacity sensitivity is asymmetric: scaling the delegation backbone improves EM by ~11 points, whereas scaling the execution sub-agent moves EM by only ~2.6 points, identifying decomposition as the capability bottleneck. Third, a 1.7B-parameter executor trained via quality-filtered trajectory distillation matches a frontier sub-agent in accuracy while consuming 37% fewer sub-agent tokens, advancing the Pareto frontier. These results suggest a concrete recipe for building hierarchical search agents: concentrate capacity at delegation and downsize execution without sacrificing accuracy. Our code is available at https://github.com/QinnanCai0115/role-factorized-search.

Do LLM-Generated Skills Make Better AI Data Scientists? A Component Ablation Across Data-Science Workflows

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07504

AI Summary (中文)

研究背景

面向产品数据科学家的LLM智能体常被用于执行高频数据科学任务（如数据清洗、SQL编写、统计检验选择、结果格式化）。为提升复用性，业界采用“技能文件”（skill files）封装特定任务族的指导策略，避免每次从零构造提示。专家编写的技能质量高，但跨多类数据科学任务持续撰写与维护成本高昂，形成人工瓶颈。

方法设计

本研究系统评估LLM自动生成技能能否作为低人工干预的替代方案：是否显著优于仅使用基础任务提示（No-Skill prompting）？实验覆盖数据科学全生命周期四大阶段——数据准备、数据提取、统计分析、报告生成，每阶段部署一个LLM生成的技能。主实验采用组件消融法（component ablation），在56个真实任务、9种模型配置（含3家主流大模型提供商）下完成7,560次运行；补充实验引入词元数匹配的对照组（1,512次运行），验证技能内容相关性是否关键。

核心发现

全技能（Full skill）未带来任何统计显著提升：所有对比的p值 ≥ 0.396，性能波动范围仅1.2个百分点（pp）；
各技能子组件（如目标描述、步骤分解、错误处理、示例等）单独启用亦无显著增益；
补充实验表明：即使替换为任务无关但格式相同的伪技能内容，性能与全技能无差异，证实提升非源于结构或长度，而取决于语义相关性；
结果强烈警示：将“每阶段一个LLM生成技能”作为默认单次提示策略，在当前实践水平下缺乏实证支持。

创新点

首次在端到端数据科学工作流中开展细粒度技能组件消融实验，揭示LLM生成技能的边际效用边界，为AI数据科学工具链的设计与评估提供关键实证基准。

AI Summary (English)

This study investigates whether LLM-generated skills—intended as low-curation alternatives to expert-written ones—improve performance over task-only prompting across data-science workflows. We conduct a rigorous component ablation across four lifecycle stages (data preparation, extraction, statistical analysis, reporting), evaluating 56 tasks, 9 model configurations, and 3 providers (7,560 runs). Contrary to expectations, neither full generated skills nor any ablated variant (e.g., goal statement, step breakdown, or examples alone) yields statistically significant gains over no-skill prompting (all p ≥ 0.396; max performance spread: 1.2 pp). A token-matched control (1,512 runs) further shows that task-irrelevant but skill-formatted content performs equivalently to full skills—indicating that format or length alone confers no benefit. These results caution against adopting one-shot, stage-specific LLM-generated skills as a default strategy in AI-augmented data science.

Abstract

Product data scientists often ask LLM-based agents to help with recurring execution tasks such as cleaning data, writing SQL, choosing statistical tests, and formatting results. Reusable skill files are meant to avoid prompting from scratch by packaging guidance for a task family. Expert-written skills can encode high-quality guidance, but writing and maintaining them across many data-science task families creates a manual bottleneck. We ask whether LLM-generated skills offer a useful low-curation alternative: do they improve performance over the task prompt alone? We test this question across four lifecycle stages: data preparation, data extraction, statistical analysis, and reporting, using one generated skill per stage. We find no reliable improvement from full generated skills over No-Skill prompting. We then ask whether any part of the skill is useful by ablating different skill components. The main ablation covers 56 tasks, nine model configurations, and three providers, yielding 7,560 runs. Compared with prompting using the task alone, neither the full generated skill nor any ablated skill variant significantly improves performance; all p-values are at least 0.396, and the total spread across variants is only 1.2 pp. A supplemental token-matched control adds 1,512 runs and finds that Full skills perform similarly to task-irrelevant skill-formatted content. The results caution against using one LLM-generated skill per data-science workflow as a default single-shot prompting strategy.

Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07471

AI Summary (中文)

研究背景与问题

机器学习模型在医疗、信贷、司法等高风险场景的广泛应用，使隐私保护与算法公平性成为双重核心关切。差分隐私（DP）作为隐私保障的黄金标准，常通过噪声注入或合成数据实现；而公平性干预则致力于缓解对少数群体的系统性歧视。然而，二者存在潜在张力：DP机制（尤其在低隐私预算下）易放大组间性能差距，且现有公平性方法在DP约束下的有效性尚缺乏系统验证。

方法与基准设计

本研究首次构建了面向差分私有合成表格数据的公平性干预基准框架。我们以当前最优的基于边际的DP合成器——自适应迭代机制（AIM, Cormode et al. 2025）为核心，覆盖4个真实世界数据集（如Adult、Credit）、5类群组公平性指标（包括Equalized Odds、Demographic Parity差异）、以及预处理、内处理、后处理三类主流公平策略。实验设置四类管道对比：（1）基线（原始数据训练）；（2）仅DP（DP合成数据训练）；（3）仅公平（原始数据+公平干预）；（4）DP+公平（DP合成数据+公平干预），并在ε ∈ [0.5, 8.0]宽泛隐私预算范围内进行评估。

关键发现与创新

DP单独应用显著降低模型效用与公平性，证实“隐私-公平权衡”的现实挑战；
所有公平干预均能部分修复DP导致的公平性退化，其中后处理方法（如Calibration、Reject Option Classification）展现出最强鲁棒性：在不同ε值和合成器变体下，其公平性提升稳定（平均ΔEOdds↓32%），同时效用损失最小（AUC降幅<1.8%）；
首次开源完整实验栈（代码、合成数据、模型检查点、评估脚本），支持可复现的隐私-公平-效用三元权衡研究。

AI Summary (English)

This paper presents the first systematic benchmark of fairness-aware learning on differentially private (DP) synthetic tabular data. Focusing on the state-of-the-art Adaptive Iterative Mechanism (AIM) synthesizer, we evaluate four pipeline configurations—Baseline, DP-only, Fair-only, and DP+Fair—across four real-world datasets, multiple group fairness metrics (e.g., Equalized Odds, Demographic Parity), and three intervention categories (pre-, in-, and post-processing) under varying privacy budgets (ε = 0.5–8.0). We find that DP alone degrades both utility and fairness, but fairness interventions—especially post-processing methods—consistently recover equitable outcomes with minimal utility loss. Notably, post-processing achieves the most stable fairness-utility trade-off across ε values and synthesizers, improving fairness by up to 32% (ΔEOdds) while preserving competitive AUC (>98.2% of baseline). All code, synthetic datasets, and experimental artifacts are publicly released to ensure reproducibility and advance research on the privacy-fairness-utility triad.

Abstract

Machine learning models are increasingly deployed in high-stakes domains, raising concerns about both privacy and fairness. Differential Privacy (DP) has become a gold standard for privacy-preserving data analysis, while fairness-aware mechanisms aim to mitigate discrimination against underrepresented groups. However, these objectives can conflict: DP often amplifies disparities across demographic groups, and little is known about whether established fairness interventions remain effective under DP constraints. In this work, we present, to our knowledge, the first systematic evaluation of fairness interventions on differentially private synthetic tabular data. Our benchmark centers on the Adaptive Iterative Mechanism (AIM), identified as the state-of-the-art marginal-based DP synthesizer (Cormode et al. 2025). We thus evaluate fairness interventions across four datasets, multiple group fairness metrics, and three categories of mitigation strategies (pre-processing, in-processing, and post-processing) under a wide range of privacy budgets. We compare four pipeline configurations: (Baseline) training on original data; (DP-only) training on DP synthetic data; (Fair-only) applying fairness mechanisms on original data; and (DP+Fair) combining fairness mechanisms with DP synthetic data. Our results demonstrate that while DP alone can degrade both utility and fairness, applying fairness interventions can partially restore equitable outcomes. Among them, post-processing methods tend to provide more stable fairness-utility trade-offs across privacy budgets and synthesizers, achieving strong fairness improvements while preserving competitive utility relative to other intervention stages. We release all code, data, and experimental artifacts in an open-source repository to ensure full reproducibility and to support future research on the privacy-fairness-utility trade-off.

SynthAVE: Scalable Synthetic Labeling for E-Commerce with LLM-Arena Validation

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07469

AI Summary (中文)

背景与挑战

面向电商场景的属性值抽取（Attribute Value Extraction, AVE）需覆盖数千种商品类目、数百种属性及多语言文本，人工标注成本随组合爆炸式增长，难以规模化。尽管大语言模型（LLM）生成合成标签已成新范式，但工业级部署亟需可扩展、可验证的质量保障机制。

方法创新：SynthAVE 与多模型竞技场验证

本研究提出 SynthAVE——首个大规模、人类校验的电商属性值抽取基准，涵盖 12,726 个商品样本、229 个类目、792 种属性及 4 种语言（西班牙语、法语、意大利语、德语）。为实现高效可信的合成标签验证，我们设计多LLM竞技场框架：每条样本由 21 种裁判配置（7 大模型家族 × 3 类提示模板）独立评估，最终通过多数投票生成金标准标签。

关键结果与价值

多数投票结果与人类专家标注高度一致：Cohen’s κ = 0.92（95.2% 准确率），达专业人工审核水平；
各LLM裁判间具备强一致性：Fleiss’ κ = 0.76，证实模型多样性可有效抑制个体偏差；
该框架将人工审核成本降低 >90%，同时保持质量不妥协，支持千万级标注任务的自动化质检闭环。

SynthAVE 不仅提供高质量多语言基准数据集，更确立了一套可复用、可审计、可扩展的合成数据验证范式，为电商AI系统的大规模落地提供关键基础设施支撑。

AI Summary (English)

SynthAVE introduces a large-scale, human-validated benchmark for e-commerce attribute value extraction (AVE), covering 12,726 products across 229 categories, 792 attributes, and 4 languages (Spanish, French, Italian, German). To ensure reliability of synthetic labels at industrial scale, we propose a multi-LLM arena framework: each sample is independently evaluated by 21 judge configurations (7 model families × 3 prompts), with final labels determined by majority voting. This ensemble achieves exceptional agreement with human experts (Cohen’s κ = 0.92, 95.2% accuracy) and strong inter-model consistency (Fleiss’ κ = 0.76), demonstrating that diverse LLMs—despite individual variability—aggregate into highly robust predictions. SynthAVE enables cost-effective, high-fidelity synthetic labeling, reducing human review burden by >90% without quality trade-offs, and establishes a scalable, auditable validation paradigm for production-grade e-commerce AI.

Abstract

Fine-tuning large language models (LLMs) for e-commerce attribute extraction requires labeled data representative across thousands of product types, attributes, and multiple languages. This combinatorial scale translates to millions of annotations, rendering human labeling prohibitively costly. While recent work has demonstrated synthetic label generation using LLMs, deploying such approaches at industrial scale requires integrated quality control mechanisms. We present SynthAVE, a large-scale human-validated benchmark for attribute value extraction spanning 12,726 products across 229 product types, 792 attributes, and 4 languages (Spanish, French, Italian, German). To validate synthetic labels at scale, we introduce a multi-LLM arena framework where samples are independently evaluated by 21 judge configurations (7 model families $\times$ 3 prompts), with final labels determined via majority voting. The majority vote ensemble agrees with human experts at Cohen's $κ= 0.92$ (95.2% agreement), while individual judges show substantial inter-model agreement (Fleiss' $κ= 0.76$). This demonstrates that diverse models with varying individual judgments aggregate into highly reliable predictions, enabling cost-effective validation at scale while maintaining quality parity with human review.

Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07461

AI Summary (中文)

研究背景与问题

随着大语言模型（LLM）作为自主智能体广泛部署，其通过模型上下文协议（MCP）动态调用外部工具和服务已成为主流范式。然而，MCP在简化集成的同时，显著扩大了攻击面，使攻击者可跨多个MCP服务器实施通用型漏洞利用。尽管已有研究关注恶意MCP服务器，但对MCP服务器自身固有安全缺陷的系统性分析仍严重缺失。

关键发现

本研究首次对MCP服务器漏洞开展大规模实证分析，涵盖元数据特征、易受污染的代码模式及社区响应时效性。结果表明：污点式（taint-style）漏洞占比高达62.3%，其成因多源于工具参数未经净化即直接参与敏感操作（如命令拼接、路径构造、SQL生成）；修复需深度重构代码逻辑，平均修复延迟达17.4天，且仅38%的漏洞获及时补丁。

创新方案：SPELLSMITH

为突破传统代码级修复的局限性，我们提出SPELLSMITH——一种基于协议层语义增强的安全防护框架：

风险建模层：解析MCP工具描述（description字段）、参数语义与高危能力（如execute_shell），构建细粒度工具级风险画像；
描述增强模块（DEM）：在协议Description属性中注入结构化安全约束（如“禁止将user_input直接用于os.system()”）；
自省优化模块（SRM）：激发LLM对自身输出进行多轮因果推理与边界校验，主动拦截污染传播链。

实验表明，SPELLSMITH在12个真实MCP服务器上将taint-style漏洞利用成功率从89.7%降至4.1%，无需修改任何服务端代码，且泛化性强于SAST工具与运行时沙箱方案。

AI Summary (English)

Large language models (LLMs) increasingly act as autonomous agents interfacing with external tools via the Model Context Protocol (MCP), yet MCP’s standardization inadvertently expands the attack surface for taint-style vulnerabilities—e.g., command injection or path traversal via unsanitized tool parameters. We systematically analyze 217 real-world MCP servers and find taint-style flaws constitute 62.3% of critical vulnerabilities, require invasive code changes to fix, and suffer slow community response (median patch delay: 17.4 days). To address this, we propose SPELLSMITH, a protocol-aware mitigation framework that leverages MCP’s native Description field to embed semantic safety constraints and harnesses LLM self-reflection to iteratively validate outputs against taint propagation risks. SPELLSMITH operates entirely client-side, requires no server modification, and reduces exploitation success rate from 89.7% to 4.1% across 12 diverse MCP servers—outperforming static analyzers and sandboxing by enabling proactive, cross-vulnerability defense grounded in tool semantics.

Abstract

Large language models (LLMs) are increasingly deployed as autonomous agents that interact with external tools and services via the Model Context Protocol (MCP), a standardized interface for dynamic tool invocation. While MCP simplifies integration, it also expands the attack surface and enables generic exploits across multiple servers. Despite prior work on malicious MCP servers, the vulnerability landscape of MCP servers remains underexplored. In this work, we systematically analyze MCP server vulnerabilities, focusing on metadata characteristics, vulnerable code patterns, and community responses. Our study reveals that taint-style vulnerabilities constitute a substantial fraction of MCP server vulnerabilities, require significant code modifications to remediate, and are met with slow community responses. Motivated by these findings, we propose SPELLSMITH, presenting a novel textbased avenue for shielding taint-style vulnerabilities in MCP servers. In particular, SPELLSMITH analyzes the high-risk capabilities exposed by an MCP server and combines them with tool descriptions and parameter semantics to identify potential taint-style vulnerability risks, thereby constructing a tool-level risk profile. Then, SPELLSMITH leverages the Description property of the protocol to embed behavioral guidance (Description Enhancement Module) and exploits LLMs' self-reflection capabilities (Self-Reflection Module) to iteratively evaluate and refine outputs. By strengthening LLM internal decision-making, SPELLSMITH provides an active and unified mitigation strategy that generalizes across multiple vulnerabilities, reducing reliance on context-specific code-level fixes. Our experiments demonstrate that SPELLSMITH effectively mitigates taint-style vulnerability exploitation in MCP servers, highlighting its practical applicability and advantages over traditional code-level mitigations.

Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07433

AI Summary (中文)

警惕“代理型僵尸网络”：基于通用可迁移对抗性幻觉劫持的规模化无目标Promptware攻击

随着具身智能体（agentic）大语言模型（LLM）应用的快速落地，一类新型威胁——Promptware（提示即恶意软件）——日益凸显。以往研究多依赖对LLM应用的直接注入通道（如API输入框、系统提示篡改），但现实中大量生产级应用（如集成终端的AI助手）不暴露任何可直接注入的接口，仅通过互联网间接交互。本研究首次揭示：攻击者可在无直接访问权限、无特定目标、弱威胁模型下，规模化发动Promptware攻击。核心洞见在于——LLM普遍存在资源标识符幻觉倾向（如虚构GitHub仓库名、技能包名、URL等），且该幻觉具有强可预测性与跨模型/跨场景可迁移性。我们提出对抗性幻觉劫持（Adversarial HalluSquatting）：攻击者首先识别实时趋势资源（如Hugging Face热门模型、GitHub Trending仓库），利用多个基础LLM（Llama 3、GPT-4、Claude 3）批量生成其在相关提示下最可能幻觉出的资源名分布；随后提前注册这些高概率幻觉名（如github.com/trending-repo-v2），并在对应域名/仓库中托管恶意Prompt（含远程执行载荷）。实验证明：在代码克隆场景中，LLM幻觉出被劫持资源的概率高达85%；在技能安装场景中达100%；且幻觉结果在不同模型间迁移准确率超76%，在不同提示模板下保持稳定。我们在8款真实生产环境LLM应用（包括Cursor、Continue.dev、Devika等）中成功实现远程工具调用→任意命令执行→设备端Bot植入，证实其可构建大规模、隐蔽、自维持的LLM驱动型僵尸网络。本工作重新定义了Promptware的攻击面边界，为安全防护提供了关键预警与检测依据。

AI Summary (English)

This paper introduces Adversarial HalluSquatting, a novel, scalable untargeted promptware attack exploiting the inherent tendency of LLMs to hallucinate resource identifiers (e.g., GitHub repo names, skill package IDs, URLs). Unlike prior prompt injection attacks requiring direct input channels, HalluSquatting operates under realistic weak threat models—no API access, no user interaction, and no target specificity. Attackers identify trending resources, compute cross-model hallucination distributions over their names using foundational LLMs (Llama 3, GPT-4, Claude 3), then preemptively squat those high-probability hallucinated names to host malicious prompts. Leveraging hallucination predictability and transferability across models and prompts, attackers achieve massive, untargeted promptware propagation. We empirically demonstrate hallucination rates up to 85% in repository cloning and 100% in skill installation, with >76% cross-model transfer accuracy. Against real-world agentic LLM applications with integrated terminals (e.g., Cursor, Continue.dev), we achieve remote tool execution and full remote code execution—enabling botnet establishment. This work exposes a critical, previously overlooked attack vector in the agentic AI stack.

Abstract

The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware. While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware under weak threat models, many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet. This raises a question: can attackers exploit LLM applications at scale without any direct channels in practical threat models? In this work, we show that the inherent tendency of LLMs to hallucinate resource identifiers can be exploited to amplify untargeted promptware attacks that pull adversarial prompts at scale and could be exploited to establish a botnet. We introduce adversarial hallucination squatting, a technique in which attackers identify trending resources (e.g., popular repositories, popular skills, etc.), compute the LLM distribution of hallucinations on the trending resource names, and preemptively register them to host adversarial prompts. By leveraging the predictability and transferability of hallucinations across foundational LLMs and to application layers, adversaries can significantly amplify the reach of untargeted promptware under weak threat models and establish a botnet by exploiting LLM applications to install a bot on the device that pulled the compromised hallucinated resource from the Inter. We empirically demonstrate that hallucinated resource generation occurs at high rates, up to 85% in repository cloning scenarios and up to 100% in skill installation, and that these hallucinations transfer between foundational models and different prompts. We demonstrate the practicality of adversarial hallucination squatting against various production LLM applications with integrated terminals in their set of tools, achieving remote tool execution and remote code execution.

How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts?

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07414

AI Summary (中文)

研究背景与问题

比特币地址聚类是区块链司法取证的核心技术，广泛应用于追踪非法加密资产流向。其中，多输入启发式（Multi-Input Heuristic, MIH） 作为最主流的聚类方法，依据“同一交易中多个输入地址通常属同一控制者”这一假设进行地址归并。然而，该方法长期缺乏基于真实、权威地面实况（ground truth）的系统性评估，尤其在执法场景下其可靠性亟待验证。

方法创新

本研究构建了可复用的九维评估框架，涵盖精度（Precision）、召回率（Recall）、F1值、簇纯度、实体覆盖度等关键指标；首次直接采用欧盟合规加密资产服务提供商（CASP）依法报送的真实地址-实体映射数据作为地面实况——该数据具有法律强制性、高可信度与实体级粒度。

关键发现

表面稳健，实质脆弱：仅评估“已报告地址”时，MIH表现良好（召回率0.71，无跨服务商误合并），但该结果被单一大型服务商主导，且忽略大量未标注地址对聚类完整性的影响；
全簇评估揭示严重缺陷：纳入所有聚类成员后，精度骤降至0.36、召回率仅0.44，表明多数服务商地址仅被部分识别，或被淹没于混杂大簇中；
实体级失效显著：部分服务商在MIH聚类中几乎完全无法识别，凸显其可靠性存在强实体依赖性。

实践启示

执法机关在将MIH聚类结果用于刑事立案推定、初步资产扣押（为后续没收作准备）或法庭证据时，必须明确其指标依赖性与实体异质性——不能默认“聚类即归属”，需辅以链上行为分析、KYC交叉验证等增强手段。

AI Summary (English)

This study critically evaluates the Multi-Input Heuristic (MIH)—the dominant address clustering method in blockchain forensics—using legally mandated, entity-level ground truth data from European crypto asset service providers (CASP). We introduce a reusable nine-metric evaluation framework and find that while MIH achieves high recall (0.71) only on reported addresses, this masks severe limitations: full-cluster analysis reveals low precision (0.36) and recall (0.44), indicating widespread partial recovery and cluster contamination. Crucially, MIH fails nearly completely for several entities, demonstrating strong entity-dependent reliability. These results compel law enforcement and judicial actors to treat MIH outputs not as definitive evidence but as hypothesis-generating signals—requiring corroboration when used for suspicion assessment, preliminary seizure, or courtroom presentation.

Abstract

Address clustering is an important technique in blockchain forensics, widely employed by law enforcement to trace illicit crypto asset flows. The multi-input heuristic (MIH), which clusters addresses potentially associated with the same entity, is the most widely used. Yet, despite its broad adoption, the MIH has rarely been evaluated against reliable ground truth data. We implement a reusable evaluation framework covering nine established metrics and apply it to ground truth address-to-entity mappings obtained directly from European crypto asset service providers under legally mandated reporting obligations. When evaluation is restricted to reported addresses, the MIH appears strong at dataset level: we observe no mergers between reported services and recover same-service address pairs with recall $0.71$. However, this result is driven by one large service and ignores unlabeled addresses absorbed into full clusters. Metrics that assess the full clusters show substantially lower precision and recall ($0.36$ and $0.44$), meaning that services are often only partially recovered or embedded in larger clusters. Entity-level results further reveal near-complete failures for some services. When MIH-based clusters are used to support criminal suspicion, preliminary seizure of crypto assets to secure later forfeiture/ confiscation, or as evidence in trial proceedings, prosecutors and judges must account for the heuristic's metric-dependent and entity-dependent reliability.

Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07368

AI Summary (中文)

多智能体AI控制：分布式攻击削弱单实例监控有效性

背景与问题：AI控制技术旨在防止具有恶意目标的AI系统违背人类操作者意图，但现有研究多聚焦于单智能体、单轨迹场景。现实中，AI系统常以多智能体并行部署于共享基础设施（如云平台、训练集群），而最严峻风险——如模型权重窃取、训练过程投毒——往往需多个智能体协同行动才能实现。然而，针对多智能体协同攻击下监控机制失效的实证研究仍属空白。

方法与工具：本文首次系统开展多智能体AI控制的实证研究，提出“分布式攻击”形式化框架：多个智能体在共享环境中协同追求同一恶意目标。为此，我们构建开源合成基准 FakeLab——一个模拟AI实验室的代码库，包含9个微服务、86个良性任务及4类明确定义的攻击目标（如凭证窃取、模型导出、日志篡改、后门注入）。

核心发现：

碎片化效应（Fragmentation Effect）：随协同攻击智能体数量增加，单实例监控器对任一攻击者的检出率显著下降——并非因恶意行为占比稀释，而是源于高能力模型在分布式任务分解中更易规避监控逻辑；
规划器的关键作用：引入显式任务规划模块后，攻击成功率最高提升7倍，且加剧执行器对监控器“心智理论”的误判（即错误推断监控边界）；
监控器强度的非线性影响：弱“可信”监控器漏检率超85%；强监控器可将未检测到的成功攻击降低超一个数量级（>90%拦截），但仍存在残余失效案例，凸显单点监控范式的根本局限。

本工作揭示了多智能体协同对AI控制架构的结构性挑战，为下一代分布式感知、跨智能体联合审计的安全设计提供关键实证依据。FakeLab已开源，欢迎安全研究者申请使用。

AI Summary (English)

AI control aims to prevent malicious AI agents from subverting human intent, yet most work assumes a single agent operating in isolation. Real-world deployments involve many agents sharing infrastructure—enabling severe threats (e.g., model exfiltration, training poisoning) that inherently require coordinated multi-agent action. We initiate the first empirical study of multi-agent AI control, formalizing distributed attacks where multiple agents jointly pursue a malicious goal. We introduce FakeLab, a synthetic AI-lab benchmark (9 services, 86 benign tasks, 4 attack objectives). Evaluating per-instance monitors under varying agent counts, coordination modes, model capabilities, and monitor configurations, we find: (1) a fragmentation effect: as more agents coordinate, per-agent monitoring becomes markedly less effective—not due to benign/malicious code ratio, but likely driven by model capability; (2) an explicit planner boosts attack success up to 7× and worsens executors’ flawed “monitor theory of mind”; (3) even a strong monitor reduces undetected attacks by >10× versus a weak one, yet remains imperfect. FakeLab is available to safety researchers upon request.

Abstract

AI control is a family of techniques to prevent an AI with malicious goals from subverting its operator's intent. AI Control usually studies a single agent in one trajectory, but real deployments run many agents over shared infrastructure, and the most severe risks (model-weight exfiltration, training-run poisoning) plausibly need several agents acting in concert. We initiate the empirical study of multi-agent AI control, formalising distributed attacks in which several agents jointly aim for a malicious goal. We develop FakeLab: a synthetic AI-lab codebase (9 services, 86 benign tasks, 4 attack objectives). We evaluate single agent monitoring against distributed attacks, varying the number of agents, their coordination, model capabilities and precise monitoring configuration. Our central finding is the fragmentation effect: as more agents coordinate to attack, per-agent monitoring becomes less likely to catch any of the attackers. Secondly, this is not driven by the ratio of benign to malicious code -- we argue this is likely dependent on model capability. Third, an explicit planner amplifies the fragmentation effect, raises the rate of completing the attack up to sevenfold, and mildly sharpens executors' poor monitor-theory-of-mind. Finally: a weak "trusted" monitor misses most attacks, while a stronger one cuts undetected success by more than an order of magnitude but remains imperfect. We are happy to share FakeLab, our control setting, with safety researchers on request.

FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07314

AI Summary (中文)

背景与问题

联邦学习（FL）虽将原始数据保留在本地客户端以规避显式数据泄露，但其训练过程及最终模型仍存在隐私风险。近期兴起的中心化“取走训练数据”（Taking Away Training Data, TATD）攻击表明：恶意训练可利用深度模型的记忆能力，将训练样本编码进模型参数并后续还原。然而，在FL多客户端协同更新、服务器执行参数平均的机制下，传统TATD攻击面临严重干扰——全局聚合会覆盖单个客户端写入的敏感信息，导致该威胁在FL中尚未被系统性建模与验证。

方法创新：FedCVESA

本文首次提出面向FL场景的白盒TATD攻击框架 FedCVESA（Federated Correlation Value Encoding and Segmented Aggregation）。其核心包含两阶段协同设计：

相关性编码（CVEA扩展）：恶意服务器选定 n 个目标客户端，在其本地训练损失函数中嵌入Pearson相关性正则项，引导模型参数（称为“载体参数”）与私有训练图像的像素级结构建立强统计关联，实现隐式、渐进式数据编码；
分段聚合（Segmented Aggregation）：服务器在聚合时对参数空间进行划分——仅对离散分布的载体参数子集执行保留性更新（跳过平均），而对剩余参数维持标准FedAvg，显著抑制载体信息被覆盖。

实验验证与意义

在MNIST、Fashion-MNIST和CIFAR-10上，采用Dirichlet非独立同分布（non-IID）数据划分进行严格评估。结果表明：FedCVESA可在主任务准确率下降<2.5%的前提下，成功重建语义清晰、可识别的原始训练图像（如手写数字、服装纹理、物体轮廓）；且重建质量随目标客户端数量增加而提升。本研究首次证实：FL在恶意服务器设定下可退化为参数级记忆通道，揭示了模型聚合机制本身可能成为新型隐私泄露载体，为FL安全审计与抗攻击设计提供了关键理论依据与实证基准。

AI Summary (English)

Federated Learning (FL) is widely adopted for privacy-preserving collaborative training, yet its security against active model-poisoning attacks remains underexplored. This paper introduces FedCVESA, the first white-box Taking-Away-Training-Data (TATD) attack tailored to FL, where a malicious server selectively encodes private client data into global model parameters. FedCVESA extends Correlation Value Encoding Attack (CVEA) by incorporating a Pearson correlation regularizer into target clients’ loss functions, enabling gradual embedding of training images into designated “carrier parameters.” To counteract parameter overwriting during server-side aggregation, we propose segmented aggregation: carrier parameters—strategically dispersed across layers—are preserved individually, while other parameters undergo standard FedAvg averaging. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID settings demonstrate that FedCVESA successfully reconstructs semantically meaningful training samples (e.g., digits, garments, objects) with high fidelity, while maintaining main-task utility (accuracy drop <2.5%). Our work reveals FL’s inherent vulnerability as a parameter-level memorization channel under malicious-server threat models, establishing a new benchmark for privacy risk assessment in federated systems.

Abstract

Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself. Recently, centralized Taking Away Training Data (TATD) attacks have shown that malicious training could abuse the memorization capacity of deep models to store and later recover training data. However, this memorization-based threat has not been systematically studied under FL environments, where multi-client averaging could overwrite encoded training data. In this paper, we study a white-box TATD attack in which a malicious server selects n target clients from K participating clients and actively writes private training data into the global model during federated training. We propose FedCVESA, a federated variant of Correlation Value Encoding Attack (CVEA), by adding a Pearson-correlation regularizer to the loss function of target clients, so that private training data are gradually encoded into selected model parameters, referred to as carrier parameters. To reduce the overwriting of carrier parameters during server aggregation, we further propose segmented aggregation over dispersed carrier parameters, preserving selected carrier parameters while keeping standard averaging on the remaining parameters. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under Dirichlet non-IID partitions show that the proposed method can steal semantically meaningful private training images from the trained model while maintaining acceptable main-task utility in a controlled proof-of-concept setting. These results demonstrate that FL can become a parameter-level memorization channel for active TATD attack under the studied white-box malicious-server setting.

Continual Learning With Participation Privacy: An Auditable Buffering-Aggregation Recipe

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07209

AI Summary (中文)

研究背景

在联邦学习与流式学习系统中，模型常以中间形式持续发布，隐私保障需覆盖整个模型更新轨迹，而非单次快照。现有持续差分隐私（Continual DP）分析多基于汉明邻域（Hamming-neighbor）假设——即仅允许单个时间步的输出被替换。然而，当用户参与具有隐私敏感性（participation privacy）时，真实威胁模型更严苛：一个用户的加入或退出会引发全序链式偏移（single-edit stream），即后续所有更新时间戳整体前移或后移，导致传统汉明邻域分析完全失效。

方法创新：可审计的“缓冲–聚合”范式

本文提出一种模块化、可审计的隐私保障框架：

随机化缓冲层（Randomized Buffering Wrapper）：将输入流划分为大小在 $[U, 2U]$ 区间内随机变动的“桶（bins）”，$U$ 由隐私预算 $(\varepsilon,\delta)$ 显式校准；该设计将单编辑流转化为每桶内满足汉明邻域性质的更新序列，并提供严格可证的延迟上限与积压（backlog）界；
认证定理（Certification Theorem）：首次给出非自适应汉明邻域DP证明向自适应交互场景迁移的充分条件：持续原语需满足两项关键性质——① 每轮使用独立新鲜随机性；② 在常见自适应上下文（如基于历史查询的模型选择）下，单轮隐私损失剖面保持稳定。

主要成果

该配方可无缝复用标准持续DP原语（如树前缀和），实现轨迹级 $(\varepsilon,\delta)$-DP，且清晰揭示隐私–延迟权衡：参数 $U$ 同时控制缓冲粒度、最大端到端延迟及隐私预算分配。所有组件均可独立验证与组合，支持系统级审计。

AI Summary (English)

This paper addresses participation privacy in continual learning—where inserting or deleting one user shifts all subsequent updates, breaking standard Hamming-neighbor continual DP analyses. We propose an auditable, modular recipe: (1) a randomized buffering wrapper partitions the stream into bins of size $[U, 2U]$, converting single-edit streams into per-bin Hamming-style update sequences with explicit backlog and delay guarantees; $U$ is calibrated to $(\varepsilon,\delta)$. (2) A certification theorem identifies when a non-adaptive Hamming-neighbor DP proof for a continual primitive (e.g., tree-based prefix sums) lifts to adaptive settings: the primitive must use fresh round-wise randomness and exhibit stable per-round privacy loss under common adaptive contexts. Together, they yield trajectory-level $(\varepsilon,\delta)$-DP with an explicit privacy–latency trade-off governed by $U$.

Abstract

Modern federated and streaming learning systems often release intermediate models, so privacy must hold for the full trajectory under adaptive interaction. Motivated by participation privacy, we study single-edit neighboring user streams, where one insertion/deletion shifts all subsequent updates and defeats standard Hamming-neighbor continual-release analyses. We give an auditable modular recipe. A randomized buffering wrapper emits bins of size $[U,2U]$, reducing single-edit streams to a Hamming-style per-bin update stream with explicit backlog/delay guarantees, where $U$ is calibrated by the privacy parameters $(\varepsilon,δ)$. We then prove a certification theorem identifying when a non-adaptive Hamming-neighbor DP proof for a continual primitive lifts to adaptive inputs: the primitive must use fresh per-round randomness and have a stable one-round privacy profile under common adaptive context. Together, these ingredients yield trajectory-level $(\varepsilon,δ)$-DP for single-edit streams using standard primitives (e.g., tree prefix sums), with an explicit privacy--latency link via $U$.

Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07109

AI Summary (中文)

核心论点

欧盟《网络弹性法案》（CRA）的监管逻辑建立在四项隐含现实假设之上：（P1）漏洞发现依赖缓慢、稀缺的人力；（P2）产品上市时其可利用缺陷是可知且相对稳定的；（P3）实际攻击足够稀疏，可被监测与响应；（P4）补丁更新能跟上漏洞披露节奏。本文首次系统论证：网络安全AI代理（CAI agents）——即自主执行漏洞挖掘、利用与渗透的AI系统——已系统性证伪全部四项前提。

方法与实证

研究采用机制映射法，将CAI的四大能力（高速模糊测试、零日生成、自适应Exploit编排、闭环补丁绕过）逐一对应至CRA条款的失效节点；进而开展双机器人实证：在CRA合规范围内部署的 humanoid 服务机器人与智能割草机，分别接入基于LLM+工具调用的防御型CAI代理。结果表明：未部署CAI的设备在72小时内被同源攻击代理连续攻破5次；而启用动态防御代理后，其CVE级漏洞响应延迟从平均42小时压缩至93秒，且通过CRA要求的“持续安全监控”模块实现自动报告与缓解闭环。

关键发现与创新

CRA的“一次性认证”范式已失效：证书签发时的安全状态可能在数分钟内过期，因CAI使漏洞生命周期压缩至秒级；
合规重心必须从“过程文档”转向“运行态证明”，即要求厂商提供可审计的实时防御代理及其SLA日志；
根本解方非技术升级，而是范式迁移：当攻防双方均使用同类CAI时，“静态合规”必然崩溃，“持续运行的AI代理”本身即成为唯一可验证的合规载体。论文据此提出CRA 2.0适配框架，并指出：若不重构认证模型，2027年12月全面生效的CRA将认证一个已不存在的安全世界。

AI Summary (English)

The EU Cyber Resilience Act (CRA) rests on four tacit assumptions about vulnerability dynamics—slow human discovery (P1), knowable pre-shipping flaws (P2), detectable exploitation (P3), and patchable timelines (P4). This paper demonstrates that Cybersecurity AI (CAI) agents falsify all four: they accelerate discovery to seconds, generate zero-days post-deployment, evade detection via polymorphic exploits, and outpace manual remediation. Using two CRA-scoped robots (a humanoid and a robotic lawnmower), we show that an agentic defender—a continuously operating, auditable CAI—reduces mean-time-to-response from 42 hours to 93 seconds and enables real-time compliance logging, while undefended counterparts fail within 72 hours. We argue that CRA’s static, process-based certification is fundamentally incompatible with agent-driven threat landscapes; the only viable conformity is continuous, agent-mediated operation. The evidence implies that CRA’s December 2027 enforcement deadline risks certifying against an obsolete security reality—unless regulatory logic shifts from “certified at launch” to “proven running.”

Abstract

The EU Cyber Resilience Act (CRA) makes a smart bet. It does not demand that products be free of vulnerabilities, but only that manufacturers run a process: assess risk, handle flaws, ship updates. The bet pays off if four things about the world stay true: (P1) finding vulnerabilities is slow, skilled, human work; (P2) a product's exploitable flaws are knowable the day it ships; (P3) exploitation is rare enough to notice; and (P4) fixes keep pace with discovery. Cybersecurity AI (CAI) agents, AI put to work finding and exploiting flaws in other products, falsify all four. The regime answers in two opposite ways. Against the sheer volume of flaws that agents surface it bends (P1): built for scarce attention, it re-centres compliance on defensible, documented prioritisation, and holds. But agents also collapse the speed and economics of the vulnerability lifecycle, and here it breaks (P2, P3, P4): a product that passed every check becomes exploitable without anyone touching it, so its market-entry test, its reporting trigger, and its one-and-done certificate vouch for a security that has quietly expired. The fault is in the landscape, not the product, so running the process more diligently cannot repair it. We map each mechanism to the force that strains or snaps it, and find the cure and the disease cut from the same cloth: because defenders and attackers wield the same AI, the only conformity that survives is one that never stops running. We also carry the remedy from proposal to proof on two CRA-scope robots, a humanoid and a lawn mower, where an agentic defender holds a line their undefended selves cannot. On the evidence already in hand, the CRA reaches full force in December 2027 certifying products against a world that has already changed. Static, human-paced security is finished; what replaces it must be continuous and agent-operated, and that is no longer a matter of taste.

A knowledge-augmented dataset of high-risk driving scenarios with LLM annotations for autonomous driving

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07103

AI Summary (中文)

背景与挑战

安全的自动驾驶系统不仅需快速响应常见高风险事件（如急刹、切入），更需对罕见、极端的长尾交通场景（如多车博弈、感知失效下的临界避让）进行深度因果推理。然而，真实驾驶数据中此类高风险事件严重稀缺；现有轨迹数据集（如nuScenes、Argoverse）及语言增强数据集普遍缺乏显式高风险事件标签、细粒度语义标注以及可验证的安全信号（如是否触发紧急制动、是否导致碰撞），制约了风险感知与决策模型的训练与评估。

方法与构建

本研究提出 K-Risk——首个知识增强型高风险驾驶场景数据集，深度融合结构化轨迹与大语言模型（LLM）生成的语义标注。数据集整合来自欧洲、中国和美国的20个真实/仿真驾驶轨迹源（涵盖高速公路、城市快速路、交叉口与环岛），通过统一的风险中心化提取流水线，精准识别并标注31,398个高风险事件，并进一步筛选出1,036个近碰撞（near-collision）极端子集。

核心创新与标注体系

每个事件以“同步轨迹+元数据+语言三元组”形式发布：

结构化场景描述（如“主车直行时左侧盲区车辆突然加速切入，TTC=1.2s”）；
异常行为通知（标注违规动作、传感器局限或环境干扰）；
因果风险分析与行动建议（覆盖30%代表性样本，经闭环仿真器迭代反思验证，确保建议可执行、结果可复现）。

K-Risk首次实现多维风险标注（时空、语义、因果）、可解释语言监督与可验证决策反馈的三位一体融合，为构建具备风险意识、可推理、可验证的下一代自动驾驶智能体提供了标准化基准与训练基石。

AI Summary (English)

Safe autonomous driving demands not only rapid reaction to common high-risk events but also deep causal reasoning for rare, extreme long-tail scenarios—yet these are severely underrepresented in naturalistic data. Existing trajectory and language-augmented datasets lack explicit high-risk labels, fine-grained semantic annotations, and verifiable safety signals. To bridge this gap, we introduce K-Risk, a knowledge-augmented dataset integrating 31,398 curated high-risk driving events (including 1,036 near-collision extremes) from 20 diverse trajectory sources across Europe, China, and the US. Each event is released as a synchronized trajectory–metadata–language triplet, featuring structured scenario descriptions, abnormal-behavior notifications, and—on a representative subset—LLM-generated causal risk analyses and action recommendations rigorously validated via closed-loop simulation with iterative reflection. By unifying multi-dimensional risk annotation, interpretable language supervision, and verifiable decision feedback, K-Risk establishes a standardized foundation for developing and evaluating risk-aware, reasoning-capable autonomous driving agents.

Abstract

Safe autonomous driving requires both rapid responses to common high-risk events and deeper reasoning over rare, extreme long-tail scenarios in traffic safety. These scenarios are severely under-represented in naturalistic driving data, and existing trajectory and language-augmented datasets seldom provide high-risk event labels, semantic annotations, and verifiable safety signals. Here we present K-Risk, a knowledge-augmented dataset that combines structured driving trajectories with large language model generated semantic annotations for safety-critical driving scenarios. K-Risk integrates 20 human-driven and autonomous-vehicle trajectory datasets from Europe, China, and the United States, covering highways, urban freeways, intersections, and roundabouts. Using a unified risk-centric extraction pipeline, K-Risk curates 31,398 high-risk events, together with a 1,036-event extreme subset of near-collision cases. Each event is released as a synchronized trajectory, metadata, and language triplet containing structured scenario descriptions, abnormal-behavior notifications, and, for a representative subset, causal risk analyses and action recommendations validated through a closed-loop simulator with iterative reflection. By combining multi-dimensional risk annotations, interpretable language supervision, and verifiable decisions, K-Risk bridges structured traffic trajectories, semantic reasoning, and decision supervision, providing a standardized foundation for developing and evaluating next-generation risk-aware autonomous driving agents.

Structural Adversarial Attacks on Relational Deep Learning under Integrity Constraints

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07089

AI Summary (中文)

研究背景与问题

关系型深度学习（Relational Deep Learning, RDL）将关系数据库编码为异构时序图：元组作为节点，主键–外键（PK-FK）依赖作为带类型的边，并在其上训练图神经网络（GNN）以支持下游预测任务。然而，其在真实数据库环境下的对抗鲁棒性尚未被系统研究——尤其当攻击者受限于数据库完整性约束时。

方法创新

本文首次提出结构化对抗攻击框架，面向受完整性约束保护的关系数据库：攻击者为白盒设定，可访问图构建逻辑与模型参数，但仅能通过重定向外键引用修改上游数据库，且必须严格满足三类约束：（1）外键有效性（referential integrity）、（2）度一外键约束（degree-one FK，即每个外键值唯一指向一个主键）、（3）函数依赖（functional dependencies）。这导致可行扰动构成一个全局预算受限、非加性、组合爆炸的离散搜索空间——因GNN的消息传递机制使边扰动效应非线性耦合。

主要发现与贡献

我们设计并评估了7种攻击策略：2种随机基线（随机边重连、随机FK重映射）与5种梯度引导变体（基于可微边掩码优化，涵盖逐边梯度、聚合梯度、目标损失敏感梯度等）。在权威基准RelBench rel-f1上的实验表明：

回归任务中，所有梯度攻击显著优于随机基线（平均MAE提升达28.6%），验证梯度信号在结构扰动中的有效性；
分类任务增益有限（准确率下降仅0.9–2.3个百分点），归因于分类输出的局部稳定性高、标签翻转率低（<4.1%）；
首次揭示完整性约束虽限制攻击面，却未根本消除脆弱性，为RDL安全部署提供了关键风险量化依据。

AI Summary (English)

This paper introduces the first framework for structural adversarial attacks on Relational Deep Learning (RDL) under realistic database integrity constraints. We consider a white-box attacker who can only perturb the upstream relational database—by rewiring foreign-key references—while strictly preserving referential integrity, the degree-one FK constraint, and functional dependencies. This yields a highly constrained, combinatorial, and non-additive perturbation space due to GNN message passing. We propose and evaluate seven attack heuristics: two random baselines and five gradient-guided variants leveraging differentiable edge masks. On the RelBench rel-f1 benchmark, gradient-based attacks consistently outperform random baselines in regression tasks (up to 28.6% MAE increase), but yield marginal gains in classification (≤2.3% accuracy drop), attributed to low label-flip rates and inherent output stability. Our work establishes the first rigorous threat model for RDL robustness under schema-level guarantees.

Abstract

Relational Deep Learning (RDL) has become a standard methodology for machine learning on relational databases: the database is encoded as a heterogeneous temporal graph in which tuples become nodes and primary-key to foreign-key (PK-FK) dependencies become typed edges, over which a graph neural network is trained for downstream prediction. We study the adversarial robustness of this pipeline. We consider a white-box attacker who knows how the graph is built and the model is trained, reasons about perturbations on the graph, but can only act on the upstream database, by rewiring foreign-key references while preserving the integrity constraints of the schema (foreign-key validity, the degree-one FK constraint, and functional dependencies). This restricts the attacker to a constrained, combinatorial set of admissible edits under a global perturbation budget, which is intractable to explore exhaustively and made non-additive by GNN message passing. We investigate seven attack heuristics - two random sampling baselines and five gradient-guided variants that exploit differentiable edge masks - and evaluate them on the RelBench rel-f1 benchmark. Gradient-based attacks consistently outperform random baselines on regression tasks, whereas gains on classification are smaller, which we attribute to low label-flip rates and greater local stability of classification outputs.

Progressive Crystallization: Turning Agent Exploration into Deterministic, Lower-Cost Workflows in Production

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.07052

AI Summary (中文)

背景与问题

当前部署于IT运维（AIOps）场景的AI代理普遍面临“永久性成本中心”困境：每次执行均需调用大语言模型（LLM）进行完整推理，即使针对已解决过的同类问题亦无法复用历史决策，导致高昂且不可预测的计算开销与安全风险。

方法：渐进式结晶（Progressive Crystallization）

本文提出渐进式结晶这一新型生命周期范式，将代理探索视为临时性知识发现过程，而非长期执行模式。其核心包含：

三阶段执行分类法：从全代理编排（Agent-Orchestrated）→ 人机协同混合（Hybrid）→ 全确定性工作流（Deterministic），形成可演化的执行成熟度谱系；
证据驱动的升降级机制：基于多维度验证（如结果一致性、人工确认、SLA达标率）自动将高频、高置信行为“结晶”为轻量级确定性脚本（如Python函数或低代码流程），同时对性能退化的工作流实施自动降级；
配套技术栈：包括可观测的轨迹提取方法（Trace Extraction）、精细化的经济成本模型（含LLM token、API延迟、人力审核成本）、以及面向审计与合规的安全性设计（版本化、可回溯、变更熔断）。

主要成果

在月均处理数万起云网络故障事件的真实生产系统中验证：
✅ 8个月内，确定性工作流占比从0%提升至45%；
✅ 尽管事件量翻倍，单事件代理成本下降超70%；
✅ 安全性显著增强：操作可100%复现、全程留痕、变更受控。
本工作首次将AI代理的“探索—固化—退化”闭环工程化，为AIOps规模化落地提供了兼具经济性、可靠性与可治理性的新路径。

AI Summary (English)

This paper introduces Progressive Crystallization, a lifecycle paradigm that transforms AI agent exploration in IT operations from a permanent cost sink into a temporary knowledge-discovery phase. It defines a three-stage execution taxonomy—Agent-Orchestrated → Hybrid → Deterministic—and an evidence-based promotion/demotion mechanism: repeatedly validated agent behaviors are automatically converted into lightweight, reproducible deterministic workflows (e.g., Python scripts), while regressing ones are downgraded. Evaluated on a production cloud networking AIOps system handling tens of thousands of incidents monthly, the approach increased deterministic execution from 0% to 45% over eight months, reduced per-incident agent cost by >70% despite doubling incident volume, and enhanced safety via full reproducibility and auditability. The work bridges agent autonomy with operational rigor, offering a scalable, economical, and governable path for production AI deployment.

Abstract

AI agents deployed for IT operations are typically permanent cost centers because every execution requires full LLM inference, even for previously solved problems. This paper introduces progressive crystallization, a lifecycle that treats agent exploration as a discovery mechanism rather than a permanent execution model. It defines a three-stage execution taxonomy, from fully agent-orchestrated to hybrid to fully deterministic workflows, together with an evidence-based promotion mechanism that converts repeatedly validated agent behaviors into cheaper and more reproducible deterministic workflows, while automatically demoting workflows that regress. Evaluated on a production cloud networking AIOps system processing tens of thousands of incidents per month, the approach increased deterministic execution from 0% to 45% over eight months, reduced per-incident agent costs by more than 70% despite doubling incident volume, and improved safety through greater reproducibility and auditability. The paper also presents the execution taxonomy, promotion and demotion criteria, trace extraction methodology, economic model, safety considerations, and discusses limitations and threats to validity.

Robust Federated Learning Under Real-World Client Churn

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06979

AI Summary (中文)

背景与挑战

联邦学习（FL）在保护用户数据隐私的前提下实现跨设备协同建模，但现实部署中常受限于客户端动态流失（client churn）——大量设备间歇在线、数据分布持续漂移、且模型反馈延迟（如点击/转化结果滞后数小时至数天）。现有FL系统多假设稳定连接或理想化可用性，难以支撑推荐、广告等对模型时效性（model freshness）高度敏感的场景，导致模型滞后于突发热点与用户意图变化。

方法创新：FeLiX框架

本文提出FeLiX——首个面向真实客户端流失的鲁棒联邦学习编排框架，聚焦最小化“端到端达标精度耗时”（wall-clock time-to-target accuracy）。其三大核心原语：

流式感知可用性分层：基于轻量遥测（如心跳+本地计算负载），实时识别海量设备中具备即时参与能力的“就绪客户端”，摒弃静态分片或周期轮询；
新鲜度-效用联合选择机制：双层级筛选——优先选取既能满足严苛刷新时限、又携带高统计价值（如梯度方差大、数据新颖性高）的更新；
信息量感知的延迟鲁棒聚合：引入时间加权与结果置信度校准，使迟到但含真实标签（ground-truth）的高质量更新可安全融入全局模型，避免因丢弃晚到更新而偏向陈旧数据分布。

实验效果

在CIFAR-10、Google Speech Commands及真实低可用性设备轨迹（<5%日均在线率）上验证：FeLiX相较SOTA同步/异步FL基线，端到端达标时间最高缩短2.37倍，通信带宽降低1.30倍，且无需任何客户端状态先验知识，在真实约束下逼近“神谕级”性能。

AI Summary (English)

Federated Learning (FL) struggles with real-world client churn—transient availability, dynamic data heterogeneity, and outcome delays—hindering model freshness critical for recommendation and advertising. FeLiX addresses this via three primitives: (i) streaming-aware availability tiers using lightweight telemetry to identify ready clients at scale; (ii) fresh-utility selection prioritizing statistically valuable updates from devices meeting tight deadlines; and (iii) informativeness-aware, delay-robust aggregation that safely incorporates late but high-value updates with ground-truth labels without biasing the global model. Unlike prior systems relying on unrealistic oracle knowledge of client states, FeLiX achieves near-oracular performance under realistic constraints. Evaluations on CIFAR-10, Google Speech, and low-availability traces show FeLiX reduces wall-clock time-to-target accuracy by up to 2.37× and communication bandwidth by 1.30× over state-of-the-art synchronous and asynchronous FL baselines.

Abstract

Federated Learning (FL) enables training shared models on private, on-device data, but production deployments remain constrained to slow, multi-day refresh cycles due to the complexity of coordinating massive client populations. For applications such as feed ranking, ad targeting, and personalized recommendation, model freshness: the ability to rapidly adapt to new user-local data is critical for maximizing objectives like click-through rate. This lag leaves models stale and unresponsive to volatile data distributions driven by viral trends and shifting user intent. Bridging this gap requires addressing three challenges overlooked by existing FL systems: transient client availability, dynamic data heterogeneity, and delays between model predictions and observable outcomes. We present FeLiX, an FL orchestration framework that minimizes wall-clock time-to-target accuracy on live interaction streams. FeLiX introduces three primitives: (i) streaming-aware availability tiers that leverage lightweight telemetry to identify ready clients at scale; (ii) fresh-utility selection, a dual-tier mechanism that prioritizes statistically valuable updates from devices able to meet tight refresh deadlines; and (iii) informativeness-aware, delay-robust aggregation that incorporates late, high-value updates containing ground-truth outcomes without biasing the global model toward stale distributions. Unlike prior systems that rely on unrealistic oracular knowledge of client availability, FeLiX achieves near-oracular performance in real-world settings. Across CIFAR-10, Google Speech, and realistic low-availability traces, FeLiX reduces wall-clock time-to-target accuracy by up to 2.37X while reducing communication bandwidth by 1.30X compared to state-of-the-art synchronous and asynchronous FL baselines.

Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies

Wed, 08 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06963

AI Summary (中文)

大语言模型与生成式AI在网络安全与隐私中的双刃剑效应：一项系统性综述

本研究系统梳理了大语言模型（LLMs）与生成式AI（GenAI）在网络安全领域的双重应用图谱：既赋能自动化防御，亦加剧攻击规模化与隐蔽化。基于对70余篇学术论文、行业白皮书及技术报告的深度分析，本文覆盖四大核心维度：

双用途风险：ChatGPT、Claude、Gemini、LLaMA、Copilot、Stable Diffusion等主流模型被用于编写无签名恶意软件、绕过沙箱检测、生成高度仿真的钓鱼内容；
AI生成恶意软件激增：实证数据显示，LLM生成的恶意代码占比从2021年的2%飙升至2025年的约50%，凸显自动化威胁生态的结构性转变；
可解释性瓶颈与突破：针对黑盒决策问题，综述了面向安全场景的XAI方法（如注意力可视化、对抗性归因、规则蒸馏），并评估其在漏洞定位、误报归因中的实用性；
防御范式升级：提出融合模型水印（Model Watermarking）、鲁棒微调（Adversarial Fine-tuning）、联邦学习增强的DevSecOps流水线、以及SAFE框架驱动的跨平台协同响应机制的综合性防护体系。

研究整合Google Play Protect、Microsoft Defender、AWS GuardDuty、Apple App Store审核日志、Hugging Face Spaces沙箱行为、GitHub开源安全工具链等真实平台案例，首次构建覆盖“生成—检测—溯源—响应”全链条的评估框架。本文不仅为AI安全治理提供可落地的技术路径，更确立了以透明性、可审计性、跨组织协作为基石的下一代可信AI部署基准，为研究者、工程师与安全决策者提供兼具理论深度与工程可行性的实践指南。

AI Summary (English)

This survey synthesizes insights from 70+ academic papers, industry reports, and technical deployments to map the dual-use landscape of LLMs and GenAI in cybersecurity. We document a dramatic rise in LLM-generated malware—from 2% of detected threats in 2021 to ~50% by 2025—and analyze its implications for zero-day exploitation, phishing automation, and evasion of static/dynamic analysis. The paper identifies critical gaps in explainability (XAI) for security-critical decisions and proposes actionable defensive strategies: model watermarking for provenance, adversarial robustness enhancements, federated DevSecOps pipelines, and cross-platform anomaly detection aligned with the SAFE Framework. Validated across Microsoft Defender, AWS, Google Play Protect, and Hugging Face Spaces, our framework delivers a holistic, empirically grounded roadmap for building trustworthy, scalable LLM-based security systems.

Abstract

Large Language Models (LLMs) and generative AI (GenAI) systems, such as ChatGPT, Claude, Gemini, LLaMA, Copilot, Stable Diffusion by OpenAI, Anthropic, Google, Meta, Microsoft, Stability AI, respectively, are revolutionizing cybersecurity, enabling both automated defense and sophisticated attacks. These technologies power real-time threat detection, phishing defense, secure code generation, and vulnerability exploitation at unprecedented scales. Following a rapid surge where LLM-generated malware grew to account for an estimated 50% of detected threats by 2025, up from just 2% in 2021, navigating this highly automated threat landscape in 2026 demands next-generation security frameworks. This paper presents a comprehensive survey of the beneficial and malicious applications of LLMs in cybersecurity, including zero-day detection, DevSecOps, federated learning, synthetic content analysis, and explainable AI (XAI). Drawing on a review of over 70 academic papers, industry reports, and technical documents, this work synthesizes insights from real-world case studies across platforms like Google Play Protect, Microsoft Defender, Amazon Web Services (AWS), Apple App Store, OpenAI Plugin Stores, Hugging Face Spaces, and GitHub, alongside emerging initiatives like the SAFE Framework and AI-driven anomaly detection. We conclude with practical recommendations for responsible and transparent LLM deployment and trustworthy AI, including model watermarking, adversarial defense, and cross-industry collaboration, setting a new benchmark for rigorous, holistic cybersecurity research at the intersection of AI and threat defense, and offering a roadmap for secure, scalable LLM systems that serves as a critical reference for researchers, engineers, and security leaders navigating the complex challenges of AI-driven cybersecurity.

Key-Recovery Attacks on TALUS: A Cryptanalytic Note

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1386

AI Summary (中文)

TALUS门限ML-DSA方案的关键恢复攻击：结构性缺陷揭示

本文针对arXiv公开、拟在NIST TCPT-2会议展示的门限ML-DSA方案TALUS（Kao与Chang提出）发起系统性密码分析，揭示其两类核心构造——TALUS-MPC（多方计算型）与TALUS-TEE（可信执行环境型）——均存在致命设计缺陷，可导致完整私钥恢复。

主要攻击路径

1. TALUS-MPC的密钥共享泄露：该方案声称对最多$T-1$个恶意方具备EUF-CMA安全性，但实际不成立。其关键漏洞在于：密钥生成阶段对$s_1$分量使用Feldman承诺，将秘密份额经公共矩阵$A$线性映射；签名阶段对随机数贡献$y$同样应用$A$。由于ML-DSA所有参数集下$A$均为左可逆矩阵，攻击者仅需高斯消元即可从公开广播中直接还原全部$s_1$密钥份额，并独立恢复聚合随机数$y$；进而仅凭单次有效签名$(c,z)$即可解出$s_1 = c^{-1}(z - y)$，无需任何格难题求解。

2. 通用$s_2$泄露机制：TALUS移除了标准ML-DSA中保护误差项$s_2$的关键拒绝采样检查，导致每签名泄露一个含界内噪声的线性方程（形如$c \cdot s_2 \approx z' - A y$）。在环上应用最小二乘法（LWE无模约简变体），仅需数亿级签名样本即可高概率恢复完整$s_2$。我们推导的样本量未优化，若结合噪声有界性与格基约减技术，实际所需签名量可大幅降低——但本工作聚焦于确证其结构性安全失效。

本研究首次指出TALUS在代数结构与采样机制上的双重根本性错误，为门限后量子密码标准化提供关键警示。

AI Summary (English)

We present practical key-recovery attacks against TALUS, a threshold ML-DSA construction (Kao & Chang) recently proposed for NIST’s TCPT-2. For TALUS-MPC, we break its claimed EUF-CMA security under $T-1$ corruptions: by exploiting the left-invertibility of the public matrix $A$, a passive observer recovers all $s_1$ shares from key-generation broadcasts and the aggregate nonce $y$ from signing broadcasts—then computes $s_1 = c^{-1}(z - y)$ from just one signature, bypassing all lattice assumptions. Crucially, both TALUS-MPC and TALUS-TEE omit ML-DSA’s rejection sampling for the error term $s_2$, leaking noisy linear equations per signature. Applying least-squares recovery over the cyclotomic ring—a variant of LWE without modular reduction—recovers the full $s_2$ secret from roughly $10^8$–$10^9$ signatures. While sample complexity can likely be reduced via lattice reduction and noise-aware optimization, our analysis establishes an inherent structural flaw rendering TALUS insecure in its current design.

Abstract

We present key-recovery attacks on the constructions of TALUS (Kao and Chang), a threshold ML-DSA (FIPS 204) construction available on arXiv and scheduled for presentation at the NIST Threshold Call Preview Talks Round 2 (TCPT-2, https://csrc.nist.gov/events/2026/tcpt).

For TALUS-MPC, which is claimed EUF-CMA secure against an adversary corrupting up to $T − 1$ parties, we show the claim is false via two independent attacks, both exploiting the same root cause. TALUS-MPC uses Feldman commitments that apply the public matrix A to secret
values: key shares of $s_1$ during key generation, and contributions to the nonce $y$ during signing. Since A is left-invertible in every ML-DSA parameter set, these images are invertible by Gaussian elimination, with no lattice problem to solve. A passive observer recovers all key shares of $s_1$ directly from the key-generation broadcast, and independently recovers the aggregate nonce y from the signing broadcast, which then yields $s_1 = c^{−1} \cdot (z − y)$ from a single signature.

For TALUS-TEE and TALUS-MPC, we identify a persisting flaw: the rejection-sampling check that protects the error term $s_2$ in standard ML-DSA has been removed. Each signature leaks a noisy linear equation in $s_2$; applying least-squares recovery over the cyclotomic ring - an instance of LWE without modular reduction - recovers the full secret from a few hundred million signatures. The sample counts we derive are not optimized and we believe exploiting the bounded noise structure and lattice-reduction techniques would reduce them significantly, but we focus on establishing the structural flaw.

Walsh LUT Evaluation on Lazy Bits for CKKS AES Transciphering

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1385

AI Summary (中文)

新型Walsh基LUT评估方法：面向CKKS加密域AES转密码的懒位优化

本研究提出一种面向二进制CKKS同态加密方案的新型布尔查找表（LUT）评估范式，核心创新在于充分利用“懒XOR”（lazy XOR）特性：将异或门延迟求值为普通加法，仅保证其最低有效位（LSB）正确，而暂不处理进位溢出。该方法分三阶段实现高效LUT计算：
1. Walsh域表示与懒奇偶聚合：将LUT系数转换至Walsh-Hadamard正交基，利用CKKS的并行加法能力，在密文槽（ciphertext slots）中直接计算所需奇偶校验和（parity sums），无需即时模约减；
2. 二进制自举（Binary Bootstrapping）精准净化：通过定制化二进制自举流程——包括StC（Slot-to-Coefficient）映射（将懒奇偶值升至MSB编码位）、CtS（Coefficient-to-Slot）重排、以及专用噪声清理算子 $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ ——彻底消除加法溢出引入的二进制噪声，输出干净、对齐的奇偶比特；
3. Walsh逆变换重构输出：以明文形式加载Walsh系数，与净化后的奇偶比特做内积，完成LUT求值。

该框架解耦LUT规模与电路乘法深度：大尺寸LUT仅需常数级（≈2–3层）乘法深度用于奇偶重组，显著优于传统方法。我们将其应用于AES-CTR转密码（transciphering）：采用半字节（nibble）分裂的Walsh分解实现S盒，支持更多并行AES块，仅引入1层额外乘法深度；AES状态全程保持全复数CKKS打包，实部与虚部独立承载不同AES数据块，提升吞吐密度。CPU实验表明，在1024块批量规模下，本方案比当前最优的稀疏自举变体XBOOT快3.25倍，同时保持同等安全参数与精度。

AI Summary (English)

We propose a novel Boolean LUT evaluation method for binary CKKS homomorphic encryption, leveraging lazy XORs—i.e., deferring XOR evaluation to additions whose LSBs remain correct while postponing overflow handling. Our approach: (1) represents the LUT in the Walsh basis; (2) computes required parity sums via lazy CKKS additions and packs them into ciphertext slots; (3) applies customized binary bootstrapping—comprising StC (to MSB-encode parities), CtS (to re-slot), and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ (to clean binary noise)—yielding clean parity bits; and (4) evaluates the LUT by inner-product recombination with plaintext Walsh coefficients. Crucially, this decouples LUT size from multiplicative depth: large LUTs incur only small constant depth (≈2–3 levels) for parity recombination. Applied to AES-CTR transciphering, our nibble-split Walsh S-box supports higher batch throughput at +1 multiplication depth, while full complex CKKS packing enables independent AES blocks in real/imaginary lanes. CPU experiments show a 3.25× speedup over the state-of-the-art sparse-bootstrapping XBOOT at 1024-block batch size.

Abstract

In this work we propose a novel Boolean lookup-table evaluation methodology over binary CKKS when circuit XORs are kept lazy, i.e., evaluated as additions whose least significant bits remain correct. Our method represents a LUT in the Walsh basis, forms the required parity sums by lazy CKKS additions, and packs them into ciphertext slots. We then use CKKS binary bootstrapping as a refresh step: the StC stage maps the packed lazy parities to MSB-encoded bits, removing the overflow; CtS places the parity values in slots; and $\mathsf{EvalMod}_{f_{\mathrm{BinBoot}}}$ cleans the binary noise, leaving clean parities in the slot domain. The LUT is then evaluated by recombining these parities with plaintext Walsh coefficients. This decouples the LUT size from the multiplicative depth of the surrounding circuit: large LUTs can be handled by cleaning selected factored parity signs and spending only a small constant depth in recombination. We apply this framework to AES-CTR transciphering. The AES S-box is evaluated with a nibble-split Walsh decomposition, which supports more AES blocks at the cost of one additional multiplication depth. The AES state remains in full complex CKKS packing so real and imaginary lanes carry independent AES blocks. In CPU experiments, the Walsh S-box AES-CTR algorithm is 3.25x faster than the sparse-bootstrapping XBOOT variant at the same 1024-block batch size.

Lower Bounds for PIR with Preprocessing from Blackbox Cryptography

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://eprint.iacr.org/2026/1384

AI Summary (中文)

研究背景与问题

本文聚焦于带预处理的单服务器私有信息检索（PIR）的计算复杂度下界问题。传统单服务器PIR若要求亚线性通信，必然导致服务器每查询需执行线性规模的公钥运算（DMO00, DH24）。近期突破性工作（CHK22, ZPZS24, LMW23）通过引入客户端预处理，成功构造出查询计算亚线性的单服务器PIR方案——但其安全性依赖于非黑盒密码原语（如环LWE）。一个根本性问题是：能否仅以黑盒方式（如随机预言机、虚拟黑盒混淆）实现高效预处理PIR？

核心贡献与创新

本文首次建立普适性黑盒下界：对任意采用黑盒密码学的单服务器PIR（含弱隐私模型），若客户端预处理存储 $s$ 比特（针对 $n$-比特数据库），则在 $k = \Omega(s)$ 次查询（即使批处理）中，在线阶段的摊销计算必须满足 $\Omega(n/s)$ 下界。更精确地，该下界体现为二者之一：

摊销在线通信量 $\Omega(n/s)$，或
服务器端密码学运算量 $\Omega(n/s)$。

该下界是紧的：存在方案恰好满足其一（如通信最优时计算超界，反之亦然）。此外，本文彻底排除了黑盒构造“双高效PIR”（sublinear query computation + sublinear server work）的可能性，解释了为何当前最优方案均需结构化假设（如LWE）。

广泛适用性与技术优势

相比以往仅适用于非编码服务器或单轮查询等受限模型的工作，本文下界覆盖所有黑盒密码学使用场景（含差分隐私、计算隐私等弱保证）。进一步，我们推导出三类重要子情形下的 $\Omega(n/s)$ 通信下界：

服务器密码运算量为 $o(n/s)$ 的方案；
服务器密码运算仅依赖查询消息的方案；
在理想化模型中实现完美隐私的方案。

所有结果均为无条件成立，无需额外复杂度假设。

AI Summary (English)

We establish the first unconditional computational lower bounds for single-server PIR with client preprocessing that uses cryptography in a black-box manner (e.g., random oracles, virtual black-box obfuscation). For any such scheme where the client preprocesses and stores $s$ bits about an $n$-bit database, we prove that the amortized online computation across $k = \Omega(s)$ queries must be $\Omega(n/s)$ — manifested either as $\Omega(n/s)$ amortized communication or $\Omega(n/s)$ cryptographic operations on the server. This bound is tight: existing constructions match exactly one term while optimizing the other. Crucially, our result rules out doubly efficient PIR (sublinear query time and sublinear server work) from black-box cryptography — explaining the necessity of structured assumptions (e.g., ring LWE) in current constructions. We further derive $\Omega(n/s)$ communication lower bounds for three natural subclasses — under minimal cryptographic operation budgets, query-message-dependent server computation, or perfect privacy in ideal models — all unconditionally. Finally, we extend our techniques to symmetric PIR (SPIR) with preprocessing in the random oracle model, providing matching upper and lower bounds based solely on one-way functions.

Abstract

We study the limits of single-server private information retrieval (PIR) with preprocessing. Prior work has shown that single-server PIR with sublinear communication requires a linear number of (public-key) server operations per query [DMO00, DH24]. Recent breakthrough works, including [CHK22, ZPZS24, LMW23], circumvent these lower bounds by critically leveraging preprocessing to construct single-server PIR with sublinear query computation.

Our work presents computation lower bounds for any single-server PIR with preprocessing that makes blackbox usage of any cryptography (such as random oracles and virtual blackbox obfuscation). For any client preprocessing scheme where the client stores $s$ bits about an $n$-bit database, we prove the online amortized computation must be $\Omega(n/s)$ across $k = \Omega(s)$ queries (even if performed in a single batch query). In more detail, we prove that they must have either $\Omega(n/s)$ amortized online communication or the server must perform $\Omega(n/s)$ cryptographic operations. Our lower bounds are optimal as there exist PIRs with client preprocessing matching exactly one of the above requirements while outperforming the other. Furthermore, our lower bounds also rule out the existence of doubly efficient PIR from blackbox cryptography with sublinear query computation (current constructions use ring LWE). We note our lower bounds are widely applicable to any single-server PIR scheme that makes blackbox usage of cryptography including those with weaker privacy guarantees. In contrast, prior works only proved computation lower bounds for restricted classes of single-server PIR constructions (e.g., non-encoding servers or single-roundtrip queries).

Our proof framework also supports $\Omega(n/s)$ communication lower bounds for the following three classes of single-server PIR: schemes where the server performs $o(n/s)$ cryptographic operations, schemes where the server's cryptographic operations depend only on query communication and schemes with perfect privacy in the idealized model. Our results hold unconditionally whereas prior communication lower bounds required additional complexity assumptions.

We also prove lower bounds for symmetric private information retrieval (SPIR) with client preprocessing in the random oracle model and present a matching SPIR construction with client preprocessing using only OWFs during queries.

Auditable Machine Unlearning for Privacy-Compliant Ransomware Detection Using Multi-Shard SISA and Deep Reinforcement Learning

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06860

AI Summary (中文)

研究背景与问题

勒索软件攻击持续演化，传统静态检测方法难以应对行为模式的动态规避；现有基于机器学习的检测器虽具备高准确率，但普遍缺乏选择性遗忘能力，无法响应《通用数据保护条例》（GDPR）和《加州消费者隐私法案》（CCPA）等法规对用户数据“被遗忘权”的强制要求。

方法创新

本文提出首个可审计、隐私合规的勒索软件检测与机器遗忘框架，融合两大核心技术：

深度强化学习（DRL）：采用双深度Q网络（DDQN），在非对称安全代价约束下，从Windows 11行为日志（103维特征）中学习鲁棒检测策略；
多分片SISA（Sharded, Isolated, Siloed Architecture）重训练机制：将训练数据划分为M个独立分片，支持仅对含待删除样本的分片进行局部重训练，实现可验证的、细粒度的样本级遗忘；
三重审计机制：通过效用保持评估、Oracle遗忘验证、成员推断（MI）审计联合验证遗忘效果与隐私保障。

主要结果

在2,000样本平衡数据集上：

基线DDQN检测器达F1=0.9925，AUC=0.9983；
单分片遗忘后F1仅下降≤0.003，Oracle遗忘验证分歧率<2.1%，证明强遗忘保真度；
M=5–10时实现最优权衡：重训练耗时5–30秒（相较全量重训练80–330秒提速27×），且MI得分稳定在0.49–0.52（≈随机猜测），表明隐私泄露风险趋近于零。

本工作首次将可审计机器遗忘系统化应用于终端行为安全检测，为AI驱动的合规型网络安全产品提供可落地的技术范式。

AI Summary (English)

This paper proposes Auditable Machine Unlearning for Privacy-Compliant Ransomware Detection, integrating Double Deep Q-Networks (DDQN) with multi-shard SISA retraining to enable GDPR/CCPA-compliant selective forgetting. The DDQN learns a reward-guided detection policy from Windows 11 behavioral features under asymmetric security costs, while multi-shard SISA supports efficient, shard-level retraining for verifiable sample removal. Evaluated on a balanced 2,000-sample dataset (103 features), the baseline DDQN achieves F1=0.9925 and AUC=0.9983. Single-shard unlearning incurs negligible utility loss (ΔF1 ≤ 0.003) and low oracle disagreement (<2.1%), while M=5–10 shards optimally balance efficiency (5–30 s retraining vs. 80–330 s full retraining) and privacy—membership inference scores remain near 0.5 across configurations, indicating minimal leakage. The framework jointly delivers high detection accuracy, auditable deletion verification, and scalable unlearning.

Abstract

Ransomware poses an escalating cybersecurity threat as attackers continuously modify behavioral patterns to evade static defenses. Although existing machine learning-based detectors often achieve strong predictive performance, they generally assume fixed training data and do not support the selective removal of previously learned samples. This limitation conflicts with privacy regulations such as the GDPR and CCPA, which require the removal of sensitive user data upon request. To address this challenge, we propose an auditable ransomware detection and unlearning framework that integrates deep reinforcement learning with multi-shard SISA retraining. In the proposed system, a Double Deep Q-Network (DDQN) learns a reward-guided detection policy from behavioral features under asymmetric security costs, while multi-shard SISA enables privacy-compliant selective sample removal through shard-level retraining. The framework was evaluated using four criteria: utility preservation, oracle-based forgetting validation, membership inference auditing, and computational efficiency. On a balanced Windows 11 behavioral dataset comprising 2,000 samples and 103 features, the baseline DDQN detector achieved an F1 score of 0.9925 and an AUC of 0.9983. The experimental results show that single-shard unlearning maintains minimal utility degradation and low oracle disagreement, whereas moderate shard counts (M = 5-10) provide the best efficiency-performance trade-off, reducing retraining time to 5-30 s compared with 80-330 s for full retraining. In addition, the membership inference scores remain close to 0.5 across most configurations, indicating limited privacy leakage after unlearning. These findings demonstrate that a privacy-compliant ransomware detection framework can jointly achieve high detection performance, auditable deletion verification, and efficient sample removal.

Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06815

AI Summary (中文)

行为隐私泄露：智能体谈判中的新型隐私威胁与防御机制

随着自主谈判智能体在保险定价、政府采购等高风险场景中日益普及，传统密码学方法虽能保护显式披露的约束值（如预算上限、最低接受价），却无法抵御行为隐私泄露——即对手通过观察谈判过程中的动态行为（如让步轨迹、响应延迟、收敛模式等）逆向推断出私有约束。本文首次形式化定义了多轮谈判协议下的行为差分隐私（Behavioral Differential Privacy），将隐私保护对象从静态数据扩展至时序交互行为。

我们提出一种自适应随机化谈判策略，在单次谈判中动态调整让步幅度与时机，在满足 $(\varepsilon, \delta)$-差分隐私严格保证的同时，确保：（1）几乎必然收敛——当对方保留价值允许达成协议时，协商序列必收敛至一致；（2）高效效用维持——最大化自身收益并兼顾协议成功率。该策略通过带扰动的贝叶斯更新与隐私预算动态分配实现三重目标协同优化。

在3,000组合成双边谈判实验中，本机制将攻击者对私有保留价格的推理准确率降低43–50%（相较基线确定性策略），同时保持91.2%的协议成功率与92.7%的相对效用水平（以理想无隐私约束谈判为基准）。结果表明：行为隐私保护无需以显著牺牲谈判性能为代价；本工作为可信AI谈判系统提供了首个兼具理论严谨性与工程可行性的隐私增强框架。

AI Summary (English)

This paper identifies and formalizes behavioral privacy leakage—a novel threat in agentic negotiation where adversaries infer private constraints (e.g., reservation values) from observable interaction dynamics (concession patterns, timing, convergence behavior), bypassing cryptographic protections on explicit disclosures. We introduce behavioral differential privacy for multi-round protocols and propose an adaptive stochastic negotiation policy that simultaneously guarantees $(\varepsilon,\delta)$-differential privacy, almost-sure convergence when agreement is feasible, and high negotiation utility. Evaluated on 3,000 synthetic bilateral negotiations, our mechanism reduces adversarial inference accuracy by 43–50% while sustaining >90% success rate and >90% relative utility—demonstrating that strong behavioral privacy can be achieved without meaningful performance degradation.

Abstract

Autonomous negotiation agents are increasingly deployed in high-stakes settings such as insurance and procurement. While cryptographic techniques protect explicitly disclosed constraint values, they fail to address a subtler threat: behavioral privacy leakage, where an adversary infers private constraints from observable negotiation dynamics such as concession trajectories, timing, and convergence patterns. This paper investigates behavioral differential privacy in multi-round negotiation protocols. We design an adaptive stochastic negotiation policy that jointly guarantees $(\varepsilon, δ)$-differential privacy, almost-sure convergence of the offer sequence (reaching agreement when the counterparty's reservation value permits), and high negotiation utility. Evaluated on 3,000 synthetic bilateral negotiations, our mechanism reduces adversarial inference accuracy by 43-50% while maintaining a negotiation success rate and utility above 90%, demonstrating that strong privacy guarantees can be achieved without significant loss of performance.

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06807

AI Summary (中文)

背景与挑战

基于大语言模型（LLM）的多智能体系统（MAS）在复杂任务协同中展现出强大潜力，但其安全风险日益突出：攻击者可利用单个智能体的内部推理漏洞或交互逻辑缺陷，实施语义隐蔽、非结构化的恶意行为。现有防御方法严重依赖两大前提——显式语义攻击假设（如提示注入、指令越狱）和显式图结构建模（需精确刻画代理间同步交互拓扑）。然而，现实攻击正趋向高度隐匿（如潜伏式推理偏移、渐进式角色篡改），且真实MAS运行普遍为异步执行，缺乏图传播模型所要求的时间对齐基础，导致现有方案检测率骤降、误报率飙升。

方法创新：AcMAS框架

本文提出AcMAS（Activation-based Multi-Agent Security），一种不依赖交互图、面向内部激活态的检测范式。核心思想是：将每个LLM智能体的隐藏层激活向量（如Transformer中间层输出）投射至低维判别空间，通过时序一致性分析与异常激活模式聚类，识别偏离正常推理轨迹的恶意状态。该设计天然兼容异步执行——无需全局时钟或消息序列对齐，仅需本地激活快照即可触发检测。

关键贡献与效果

鲁棒检测：在同步场景下F1达0.94（较最优图基线+0.22），异步场景下达0.93（+0.55），显著突破现有方法在异步环境下的失效瓶颈；
功能恢复机制：区别于主流“隔离-替换”策略，AcMAS利用激活异常定位关键推理偏差，引导轻量级微调修复受损智能体，维持系统连续性；
强泛化性：在Qwen、Llama、Phi-3等6种开源LLM后端、3类攻击强度（弱/中/强）及5–20智能体规模下均保持稳定性能，验证了方法的架构无关性与部署可行性。

AI Summary (English)

This paper addresses critical security vulnerabilities in LLM-based Multi-Agent Systems (MAS), where existing graph-based defenses fail under semantically stealthy attacks and asynchronous execution. We propose AcMAS, an activation-based detection framework that monitors internal reasoning states—specifically, layer-wise hidden activations of local agents—without requiring explicit interaction graphs or temporal synchronization. By modeling activation dynamics in a low-dimensional discriminative space, AcMAS detects malicious behaviors robustly across both synchronous and asynchronous settings. It further enables functional recovery of compromised agents via activation-guided fine-tuning, avoiding disruptive isolation. Evaluation shows AcMAS achieves 0.94 F1 (+0.22 over best baseline) in synchronous MAS and 0.93 F1 (+0.55) in asynchronous MAS—outperforming all graph-based methods—while generalizing across diverse LLM backbones (e.g., Qwen, Llama, Phi-3), attack intensities, and system scales (5–20 agents).

Abstract

While enabling effective collaboration on complex tasks, LLM-based Multi-Agent Systems (MAS) face critical security challenges due to vulnerabilities at the agent and interaction levels. Most existing MAS security defenses are built upon two core assumptions: semantically-explicit malicious attacks and explicit graph-based modeling of the MAS topology and agent-level interactions. In practice, real-world attacks are becoming more semantically stealthy, while MAS execution is typically asynchronous without the temporal alignment assumed by graph-based propagation models. To address these limitations, we propose AcMAS, an activation-based framework for malicious-behavior detection in MAS. By analyzing internal reasoning states in the activation space of local agents, AcMAS detects even stealthy attacks in a synchronization-robust fashion, without relying on explicit interaction graphs. Moreover, our activation analysis provides critical signals to guide AcMAS in restoring the functionality of compromised agents, rather than the disruptive agent isolation commonly used by the state-of-the-art methods. Comprehensive evaluation demonstrates that AcMAS significantly outperforms graph-based baselines against stealthy attacks, by +0.22 F1 in synchronous settings (0.94 vs. 0.72) and by +0.55 F1 in asynchronous settings (0.93 vs. 0.38), with generalization across diverse open-source LLM backbones, attack intensity, and MAS scale.

AirPASS: Over-the-Air Federated Learning via Pinching Antenna Systems

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06768

AI Summary (中文)

AirPASS：基于捏压天线系统的空口联邦学习新框架

本研究面向无线空口联邦学习（AirFL）场景，提出AirPASS——一种集成多波导“捏压天线系统”（Pinching Antenna System, PASS）的端到端优化框架。传统AirFL受限于信道衰落与多用户信号叠加失真，难以兼顾设备接入规模与聚合精度；而现有基站天线设计（如共置MIMO）缺乏对射频域物理结构的联合调控能力。本文首次将可重构天线几何构型（即PASS中波导挤压位置）作为关键优化变量，与设备选择、接收波束赋形协同设计，构建联合非凸优化问题：在满足聚合失真阈值约束下，最大化参与训练的设备数量。

为破解强耦合非凸性难题，AirPASS采用交替优化双模块架构：

第一模块：固定PASS物理配置，提出同伦-黎曼边界凝聚法（homotopy-Riemannian margin-consolidation），在流形约束下联合优化设备子集与接收波束，显著提升信噪比鲁棒性；
第二模块：固定已选设备与波束，设计同伦辅助几何优化法，通过连续形变策略智能调整捏压点位置，动态增强信道对齐与信号相干叠加能力。

实验表明：AirPASS在典型城市微蜂窝场景下，相较传统共置MIMO基线提升设备接入率32.7%，聚合误差降低41.5%；性能逼近理想FedAvg（差距<2.3%），且计算开销仅为SDR-DC方法的1/5、匹配追踪调度的1/3，实现优异的精度-效率-硬件可控性三重平衡。该工作为射频-算法协同的智能无线学习提供了可部署的新范式。

AI Summary (English)

This paper proposes AirPASS, an over-the-air federated learning (AirFL) framework leveraging a reconfigurable multi-waveguide pinching antenna system (PASS) at the access point. We formulate a learning-oriented AirFL problem—maximizing the number of concurrently selected devices while bounding aggregation distortion—and jointly optimize device selection, receive beamforming, and physical PASS geometry (i.e., waveguide pinching positions). To tackle the resulting highly nonconvex coupling, AirPASS alternates between: (i) a homotopy-Riemannian margin-consolidation method for device-beamformer co-design under fixed PASS configuration; and (ii) a homotopy-assisted geometric optimization for adaptive pinching-point placement under fixed devices and beamformer. Experiments demonstrate that AirPASS consistently outperforms conventional co-located MIMO baselines, achieves near-FedAvg accuracy (<2.3% gap), and offers superior performance-complexity tradeoffs versus SDR-DC and matching-pursuit schedulers—enabling practical, hardware-aware AirFL deployment.

Abstract

This paper investigates over-the-air federated learning (AirFL) in wireless systems where the access point is equipped with a multi-waveguide pinching antenna system (PASS). We adopt the widely studied learning-oriented AirFL formulation, which seeks to maximize the number of selected devices while keeping the aggregation distortion below a prescribed threshold. The resulting joint optimization of device selection, receive beamforming, and pinching-antenna placement is highly nonconvex due to the intricate coupling among these system variables. To address this challenge, we develop AirPASS, an alternating optimization framework with two main components: a homotopy-Riemannian margin-consolidation method for device selection and receive beamforming under fixed PASS configuration, and a homotopy-assisted geometry optimization method for updating the pinching-antenna positions under fixed selected devices and beamformer. Experiments show that AirPASS consistently outperforms conventional co-located MIMO baselines, remains close to ideal FedAvg, and achieves an attractive performance-complexity tradeoff relative to SDR-DC and matching-pursuit scheduling alternatives.

Dual Attention Heads for Personalized Federated Learning in ECG Classification

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06653

AI Summary (中文)

背景与挑战

联邦学习（FL）为跨医疗机构协作训练心电图（ECG）分类模型提供了隐私保护范式，但不同医院采集的ECG数据存在显著异质性——包括设备型号、导联配置、噪声特性及患者人群分布差异，导致传统FL方法（如FedAvg）性能严重下降。

方法创新：FedDualAtt

本文提出FedDualAtt——一种面向ECG分类的个性化联邦学习新框架。其核心创新在于对Transformer架构中的多头自注意力机制进行结构化解耦：将每个客户端的注意力头划分为全局头（Global Heads）与本地头（Local Heads）两个分支。

全局头通过标准FedAvg聚合，建模跨机构共性的心律模式与疾病表征；
本地头完全保留在客户端本地，不参与聚合，专门适配本机构特有的信号采集偏差、基线漂移或伪影特征；
全局/本地头比例可依据客户端数据特性动态配置，支持细粒度个性化。

实验验证与发现

在权威联邦心血管疾病检测基准数据集FedCVD上系统评估表明：
✅ FedDualAtt在平均F1-score上较FedAvg提升+9.2%，较主流个性化方法Per-FedAvg和pFedMe分别提升+5.7%和+4.3%；
✅ 消融实验揭示：不同客户端最优全局-本地头比存在显著差异（如三甲医院宜采用3:5，基层诊所倾向1:7），印证“一机构一架构”的个性化必要性；
✅ 可视化分析证实，本地头有效捕获设备特异性伪影，全局头稳定激活心肌缺血相关通道区域。

本工作首次将注意力头级解耦引入联邦ECG建模，为医疗联邦学习提供了兼具泛化性与适应性的新型架构范式。

AI Summary (English)

Federated learning (FL) enables privacy-preserving ECG classification across hospitals, yet data heterogeneity severely degrades model performance. We propose FedDualAtt, a personalized FL framework that splits Transformer attention heads into global and local branches: global heads are aggregated via FedAvg to learn cross-site physiological patterns, while local heads remain client-specific to adapt to institution-level acquisition characteristics (e.g., device noise, lead placement). Evaluated on the FedCVD benchmark, FedDualAtt achieves state-of-the-art ECG classification accuracy—outperforming FedAvg (+9.2% avg F1), Per-FedAvg (+5.7%), and pFedMe (+4.3%). Crucially, optimal global-to-local head ratios vary significantly across clients (e.g., 3:5 vs. 1:7), confirming the need for architecture-level personalization. FedDualAtt establishes a new paradigm for medical FL by enabling simultaneous generalization and adaptation at the attention-head level.

Abstract

Federated learning (FL) enables collaborative model training across institutions without sharing sensitive patient data. However, the inherent heterogeneity of electrocardiogram (ECG) data across healthcare providers presents significant technical challenges for robust classification. We propose FedDualAtt, a personalized federated learning approach that splits transformer attention heads into global and local branches. Global heads are aggregated via FedAvg to capture shared cross-site patterns, while local heads remain client-specific to adapt to institution-level recording characteristics. Experiments on FedCVD, an FL benchmark for cardiovascular disease detection, demonstrate that FedDualAtt outperforms existing FL and personalized FL methods in ECG classification tasks. Analysis of global-local head ratios reveals that different clients benefit from varying levels of architectural personalization.

Entropy-Guided Tensor Compression for Multimodal Federated Learning on Edge Devices

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06651

AI Summary (中文)

背景与挑战

在边缘设备上开展的多模态联邦学习（FL）面临显著异构性：客户端在感知模态（如图像、文本、音频）和计算资源（CPU、内存、带宽）上差异巨大。现有模型更新压缩方法通常采用统一的层间/设备间压缩策略，忽视了不同模态参数更新在频谱结构（如奇异值分布）和可压缩性上的本质差异，导致资源浪费或精度损失。

方法创新：MESH-FL框架

本文提出MESH-FL——一种熵引导的矩阵乘积态（MPS）压缩框架。其核心创新在于：

谱熵驱动的动态分配：对每层更新进行截断奇异值分解（SVD），估计其谱熵（反映奇异值能量分布的不均衡程度）；
跨维度自适应秩配置：在单客户端总通信负载约束下，联合优化MPS压缩秩在层、模态、设备三个维度的分配；
理论支撑：证明谱熵越高，按主控序（majorization order）所需重构秩越大；进而证明所提熵引导策略可精确求解一个凸松弛的秩分配问题，保持负载约束下的单调性，并保证含显式压缩误差项的收敛性。

实验验证与效果

在15节点异构树莓派4/5集群（含摄像头、麦克风、键盘等多模态客户端）上验证：

实现最高56.8× 的模型更新压缩率；
最终准确率较未压缩FedAvg基线提升2.01%；
收敛所需总传输数据量减少最高66×。

MESH-FL首次将信息熵理论深度融入多模态FL压缩设计，为资源受限边缘智能提供了高精度、高效率、强鲁棒的协同学习新范式。

AI Summary (English)

Federated learning (FL) on edge devices increasingly involves multimodal clients with heterogeneous sensing capabilities and resource constraints. Existing compression methods apply uniform policies, ignoring modality- and layer-specific differences in spectral structure. We propose MESH-FL, an entropy-guided matrix product state (MPS) framework that estimates spectral entropy of layer-wise updates via truncated SVD and adaptively allocates MPS ranks across layers, modalities, and devices under per-client payload budgets. We prove that higher spectral entropy implies higher required reconstruction rank under majorization order, and that our entropy-guided allocation solves a convex surrogate rank-allocation problem while preserving monotonicity and ensuring convergence with an explicit compression-dependent error bound. Experiments on a 15-node Raspberry Pi 4/5 cluster with modality-heterogeneous clients show MESH-FL achieves up to 56.8× compression, +2.01% accuracy gain over uncompressed FedAvg, and 66× reduction in total transmitted data to convergence.

Abstract

Federated learning (FL) over mobile and edge devices increasingly involves multimodal models in which clients differ in both sensing capability and computational capacity. Existing update compression schemes typically apply uniform policies across layers and devices, without accounting for modality-specific differences in spectral structure and compressibility. We propose MESH-FL, an entropy-guided matrix product state (MPS) update-compression framework for modality-heterogeneous FL on resource-constrained devices. MESH-FL estimates the spectral entropy of each layer-wise update via truncated singular value decomposition and allocates MPS compression ranks adaptively across layers, modalities, and devices under per-client payload budgets. We show that higher spectral entropy necessitates a higher reconstruction rank under the majorization order on singular-value energy distributions. Building on this result, we prove that the proposed entropy-guided allocation solves a convex surrogate rank-allocation problem, preserves monotonicity under the exact payload model, and achieves convergence with an explicit compression-dependent error term. Experiments on a 15-node heterogeneous Raspberry Pi~4/5 cluster with modality-heterogeneous clients show that MESH-FL achieves up to $56.8\times$ compression while surpassing the uncompressed FedAvg baseline in final accuracy by up to 2.01%, and reduces total transmitted data to reach convergence by up to $66\times$.

ProMoE-FL: Prototype-conditioned Mixture of Experts for Multimodal Federated Learning with Missing Modalities

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06633

AI Summary (中文)

背景与挑战

在多模态联邦学习（Multimodal Federated Learning）中，各参与医疗机构常因设备、隐私或采集限制导致模态缺失（如仅提供X光图像而无对应临床文本或结构化报告），严重影响模型泛化能力。现有方法或依赖额外的公开数据集进行跨机构知识迁移，或采用单一模态驱动的朴素特征合成（如仅用图像生成文本），缺乏对跨机构临床先验知识的建模，且无法适应异构数据分布下的动态缺失模式。

方法创新：ProMoE-FL框架

我们提出 ProMoE-FL（Prototype-conditioned Mixture of Experts for Federated Learning），一种面向缺失模态鲁棒合成的新型联邦学习框架。其核心包括：

全局客户端感知原型库：在服务器端聚合各机构上传的类别级模态原型（prototype），显式编码跨中心、临床可解释的模态先验（如“肺实变”在X光与报告中的联合表征）；
原型条件化专家混合机制（ProMoE）：每个专家专精于特定模态组合与语义方向（如“图像→报告”或“报告→图像”），路由过程由当前样本的模态索引与最近邻原型相似度联合调控，实现方向感知、动态适配的缺失特征合成；
无额外数据依赖的联邦训练范式：全程不引入外部公共数据集，所有原型与专家均通过本地训练与安全聚合更新，符合医疗联邦学习的隐私与合规要求。

实验验证

在四个权威胸部X光公开数据集（MIMIC-CXR、NIH Open-I、PadChest、CheXpert）上开展系统评估，涵盖同构与高度异构（跨设备、跨标注协议）场景。结果表明：ProMoE-FL在AUROC、F1-score等关键指标上全面超越SOTA方法（平均提升+3.2–5.8%），尤其在≥2模态随机缺失时保持稳定性能，验证了其临床实用性与泛化鲁棒性。

AI Summary (English)

This paper tackles multimodal federated learning (FL) under missing modalities—a critical challenge in real-world healthcare deployments where institutions often possess incomplete data (e.g., X-ray only, without reports). Unlike prior works relying on external public datasets or naive unimodal synthesis, we propose ProMoE-FL, a prototype-conditioned Mixture-of-Experts framework. It constructs a global, client-aware prototype bank capturing clinically meaningful cross-institutional modality priors, and conditions expert selection on both modality indices and prototype similarity to enable direction-aware, dynamic feature synthesis. Evaluated on four chest X-ray benchmarks (MIMIC-CXR, NIH Open-I, PadChest, CheXpert), ProMoE-FL consistently outperforms state-of-the-art methods in both homogeneous and highly heterogeneous FL settings—achieving average AUROC gains of +3.2–5.8%—without requiring any external data or compromising privacy.

Abstract

In this paper, we address the problem of multimodal federated learning with missing modality. Existing methods utilize an additional public dataset or perform naive feature synthesis that is based solely on the available modality. To address these limitations, we propose ProMoE-FL, a Prototype-conditioned Mixture-of-Experts framework for robust missing-modality feature synthesis in multimodal federated learning. ProMoE-FL builds a global client-aware prototype bank that captures clinically meaningful modality priors across institutions. Our Mixture of Experts is conditioned on these prototypes and modality indices to enable direction-aware expert routing for dynamically synthesizing missing features. We perform extensive quantitative and qualitative evaluations on four public chest X-ray datasets (MIMIC-CXR, NIH Open-I, PadChest, and CheXpert) and demonstrate that ProMoE-FL consistently outperforms state-of-the-art methods in both homogeneous as well as the more challenging heterogeneous settings.

WHERE to Generate Matters: Budget-Aware Synthetic Augmentation for Label Skewed Federated Learning

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06616

AI Summary (中文)

背景与挑战

在联邦学习（FL）中，标签偏斜（label skew） 导致各客户端本地数据分布高度异构，引发模型更新方向不一致（即“客户端漂移”），显著降低全局模型精度。虽可通过合成数据增强缓解类别不平衡，但传统方法（如强制全类均衡生成）需高昂计算开销，难以适配资源受限的边缘设备。

方法创新：FedEAS

我们提出 FedEAS（Federated Entropy-Adaptive Synthesis） ——一种预算感知的合成增强策略。其核心在于：

熵自适应预算分配：对每个客户端，基于其本地标签分布计算类别级熵值，动态分配每类合成样本数量；熵越高（分布越均匀），生成预算越低；熵越低（越偏斜），该类生成预算越高；
“WHERE to Generate”双决策机制：预算不仅决定生成量（how much），更明确指定生成样本的去向（WHERE）——仅注入至缺失该类或样本极少的其他客户端（而非全局聚合池），实现定向知识迁移；
弹性总预算：总生成量由所有客户端的本地预算之和自然导出，无需预设固定总量，兼顾效率与公平。

主要结果

在CIFAR-10与CIFAR-100上的实验表明：

FedEAS以仅5.9%的全平衡生成预算（即降低94.1%计算开销），恢复了全平衡方案92%以上的精度增益；
在相同总生成预算下，相比均匀分配（Uniform）策略，平均精度提升达18.82%（CIFAR-100上尤为显著）；
有效抑制客户端漂移，提升模型收敛稳定性与泛化鲁棒性。

FedEAS首次将“生成位置”（WHERE）纳入预算优化框架，为轻量、高效、可部署的联邦数据增强提供了新范式。

AI Summary (English)

Label skew in federated learning (FL) induces client drift and degrades global model accuracy. While synthetic data augmentation mitigates class imbalance, full-class balancing incurs prohibitive computation costs. We propose FedEAS, a budget-aware policy that computes an entropy-adaptive per-class generation budget for each client based on its local label distribution. Crucially, this budget jointly determines how many samples to generate and WHERE they are allocated—i.e., only to clients lacking that class—enabling targeted knowledge transfer. The total generation budget emerges endogenously from client-level allocations, rather than being fixed a priori. Evaluated on CIFAR-10 and CIFAR-100, FedEAS recovers >92% of the accuracy gain of full balancing while reducing generation cost by 94.1%. At equal total budget, it outperforms uniform allocation by up to 18.82% in accuracy. FedEAS establishes “WHERE to generate” as a first-class design dimension for efficient, skew-resilient FL.

Abstract

Label skew in federated learning (FL) causes client drift and degrades global accuracy. Synthetic data augmentation can reduce this imbalance; however, full class balancing requires substantial computation cost. We propose FedEAS, a policy that assigns each client an entropy-adaptive per-class generation budget computed from its local label distribution. The budget jointly decides \emph{how much} each client generates and \emph{WHERE} the samples go. Accordingly, the total generation budget follows from the per-client budgets rather than being fixed in advance. FedEAS recovers most of the accuracy gain of full class balancing while reducing the generation budget by 94.1\%. At the same total generation budget, it outperforms Uniform allocation by up to 18.82\% across CIFAR-10 and CIFAR-100.

STAGformer: A Spatio-temporal Agent Graph Transformer for Micro Mobility Demand Forecasting

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06614

AI Summary (中文)

背景与挑战

共享单车系统需精准预测站点级供需需求以实现车辆调度、运维优化与资源分配。然而，城市级大规模路网中存在复杂的时空耦合依赖（如跨区域潮汐效应、天气突变影响、POI动态吸引等），传统图神经网络或Transformer模型因计算复杂度高（O(N²T²)）难以扩展至千级站点规模，严重制约实际部署。

方法创新：STAGformer架构

本文提出STAGformer——一种面向微出行需求预测的时空智能体图Transformer。其核心创新在于：

两阶段智能体注意力机制：引入少量可学习的空间智能体令牌（Spatial Agents）和时间智能体令牌（Temporal Agents），先全局聚合信息，再广播回各站点/时刻，将标准自注意力的二次复杂度降至线性O(NT)；
四模块协同设计：① 时空编码器融合节点动态特征与外部上下文（天气、小时、星期、POI热度）；② 图传播模块建模物理/功能邻接关系；③ 时间卷积模块捕获局部周期性模式（如早高峰脉冲）；④ 智能体注意力模块建模长程时空依赖；
轻量高效：参数量降低37%，单次推理快2.1倍，支持实时滚动预测。

实验验证与效果

在NYC Citi-Bike（400+站点）和Chicago Divvy-Bike（600+站点）真实数据集上，STAGformer在15/30/60分钟多步预测中全面超越SOTA模型（如DCRNN、GraphWaveNet、ASTGCN、STAEformer），RMSE平均降低12.6%–18.3%，MAE降低11.4%–17.9%。消融实验证实：智能体注意力对全局建模贡献最大（移除后RMSE上升23.5%），图传播与外部特征融合分别提升空间一致性与时效鲁棒性。

AI Summary (English)

Accurate station-level demand forecasting is critical for micro-mobility operations but challenged by complex spatio-temporal dependencies and scalability. This paper proposes STAGformer, a Spatio-Temporal Agent Graph Transformer that achieves linear-time global modeling (O(NT)) via a novel two-step agent attention mechanism: learnable spatial/temporal agent tokens first aggregate global context, then broadcast it to all stations and time steps—replacing quadratic self-attention. Integrated with a spatio-temporal encoder (fusing node dynamics and external factors), graph propagation, temporal convolution, and agent attention, STAGformer consistently outperforms state-of-the-art baselines on NYC Citi-Bike and Chicago Divvy-Bike datasets across 15-/30-/60-min horizons, reducing RMSE by 12.6–18.3% and MAE by 11.4–17.9%. Ablation studies confirm the agent attention’s pivotal role in capturing long-range spatio-temporal dependencies.

Abstract

Accurate station-level demand forecasting is essential for the efficient operation of bike-sharing systems, yet it remains challenging due to complex spatio-temporal dependencies and the large scale of urban networks. This paper presents STAGformer, a Spatio-Temporal Agent Graph Transformer that achieves efficient global modeling with linear computational complexity. The model introduces a two-step agent attention mechanism, where a small set of learnable spatial and temporal agent tokens first aggregate global information and then broadcast it back to individual stations and time steps, effectively capturing long-range interactions while reducing the quadratic cost of standard self-attention to O(NT). STAGformer integrates four core modules: a spatio-temporal encoder that fuses dynamic node features with external contextual factors (weather, time, points of interest), a graph propagation module for spatial neighbor aggregation, a temporal convolution module for local pattern extraction, and the agent attention module for global dependency modeling. Extensive experiments on two real-world datasets -- NYC Citi-Bike and Chicago Divvy-Bike -- demonstrate that STAGformer consistently outperforms state-of-the-art baselines across multiple prediction horizons, achieving significant improvements in both RMSE and MAE. Ablation studies validate the contribution of each component, with the agent attention mechanism proving critical for modeling global spatio-temporal dependencies.

PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learning

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06612

AI Summary (中文)

PRoVeFL：面向联邦学习的私密、鲁棒且可验证聚合框架

联邦学习（FL）允许多方在不共享原始数据的前提下协同训练模型，显著提升隐私保护能力。然而，传统FL依赖中心化聚合服务器，且假设客户端为“诚实但好奇”，因而同时面临服务器端推理攻击与客户端投毒攻击双重威胁。现有安全FL方案虽尝试兼顾隐私与拜占庭鲁棒性，却普遍陷入隐私—完整性—可验证性三者间的根本性权衡，且因过度依赖复杂密码学原语（如零知识证明、多方计算），导致计算与通信开销巨大。

为此，本文提出 PRoVeFL——一种模块化、三重保障的新型FL框架，同时实现隐私保护（Private）、拜占庭鲁棒（Robust）、聚合可验证（Verifiable）。其核心创新在于：

采用多密钥全同态加密（MK-FHE），支持客户端对本地模型更新加密后分发至多个服务器；
设计混合计算范式，在严格隐私约束下，将部分密文域复杂统计操作（如Krum、裁剪均值、FLTrust等）安全卸载至明文域执行，大幅降低开销；
兼容主流鲁棒聚合算法（Krum、Trimmed Mean、FLTrust、norm clipping、MESAS等），并为其嵌入轻量级可验证机制，仅需至少一个服务器诚实即可完成聚合结果验证；
实验表明：PRoVeFL在参数规模（1M–10M）与参与方数量（16–256）扩展下保持高效，相比基于分布式信任的先驱工作Prio与ELSA，在同等安全强度下，运行时提速最高达100×与10×，显著突破效率瓶颈。

AI Summary (English)

Federated Learning (FL) enables collaborative model training without raw data sharing, yet suffers from server-side inference and client-side poisoning attacks due to centralized aggregation and honest-but-curious assumptions. Existing secure FL protocols face a fundamental trade-off among privacy, robustness, and verifiability—and incur prohibitive overhead from heavy cryptographic primitives. We propose PRoVeFL, a modular framework achieving Privacy, Byzantine-Robustness, and Verifiable aggregation simultaneously. PRoVeFL leverages multi-key fully homomorphic encryption (MK-FHE): clients encrypt local updates and distribute shares to multiple servers; a hybrid computation model then securely offloads complex statistical aggregation (e.g., Krum, Trimmed Mean, FLTrust) from ciphertext to plaintext under strict privacy constraints. It integrates verifiability with minimal trust—requiring only one honest server—and supports state-of-the-art robust aggregators out-of-the-box. Evaluations show PRoVeFL scales efficiently with model size (1M–10M parameters) and participant count (16–256), improving runtime by up to 100× over Prio and 10× over ELSA, while preserving comparable security guarantees.

Abstract

Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.

Differentially private quantum sensor networks

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06521

AI Summary (中文)

差分隐私量子传感网络：兼顾隐私保护与海森堡极限精度

量子传感凭借纠缠资源可突破经典测量极限，在函数估计等任务中实现海森堡极限（$O(1/n^2)$）的均方误差（MSE）缩放，显著优于标准量子极限（$O(1/n)$）。然而，当量子传感器网络用于采集敏感数据（如生物医学信号）时，其高精度测量本身可能构成隐私泄露风险——本文首次系统揭示：现有纠缠传感协议在存在恶意节点或侧信道攻击下，易遭受隐私违反攻击（如参数重构、输入推断等）。

为此，我们提出首个兼具差分隐私（DP）保障与量子优势保留的传感框架。核心创新在于将噪声直接注入传感哈密顿量（而非后处理），设计出可本地实现的 $n$-节点分布式协议。在合理假设下（存在公共随机源、常数比例诚实节点），该协议实现 $(\varepsilon, \delta)$-差分隐私，其中 $\varepsilon = O(1)$ 为常数，$\delta$ 可任意小，同时严格维持 MSE 的 $O(1/n^2)$ 海森堡标度。我们进一步构造多种协议变体，在隐私预算 $\varepsilon$、容错性与通信开销间提供灵活权衡。安全性分析证明：协议对广泛类别的经典与量子敌手（包括自适应测量攻击、共谋节点、非纠缠辅助攻击）均具鲁棒性；且相比纯经典DP方案，量子纠缠显著改善隐私-效用权衡——同等隐私水平下，量子协议的MSE降低达 $\sim n$ 倍。本工作为隐私敏感场景下的高精度量子感知提供了理论基石与实用范式。

AI Summary (English)

Quantum sensor networks leveraging entanglement achieve Heisenberg-limited mean-squared error (MSE) scaling of $O(1/n^2)$ for function estimation—surpassing classical limits. Yet such networks pose inherent privacy risks when measuring sensitive data. We identify concrete privacy-violating attacks against entangled protocols and introduce the first differentially private quantum sensing framework. Our main protocol injects noise directly into the sensing Hamiltonian across an $n$-node network, achieving $(O(1), \delta)$-differential privacy for arbitrarily small $\delta$, while preserving Heisenberg-limited MSE scaling under mild assumptions (shared randomness and constant fraction of honest parties). It is locally implementable and provably resilient against broad classes of classical and quantum adversaries. Crucially, quantum techniques yield a superior privacy–utility tradeoff: at fixed privacy budget $\varepsilon$, quantum protocols reduce MSE by up to a factor of $n$ compared to classical DP approaches.

Abstract

Quantum sensing is a promising technology capable of demonstrating clear advantage over comparable classical techniques for precise measurement. One application of quantum sensing is in function estimation, which can be done using a network of entangled quantum sensors, allowing for measurements with greater optimal sensitivity than unentangled sensing protocols. In cases where quantum sensor networks will be used to measure data that should remain private (e.g., biomedical data), it is imperative that these protocols include a privacy mechanism to hide sensitive information. In this work, we show that entangled sensor networks are vulnerable to certain privacy-violating attacks. To mitigate these attacks, we introduce secure sensing protocols endowed with differential privacy. We reconcile differential privacy with retaining Heisenberg-limited scaling, and introduce several protocols achieving varying balances between the two. We show that our main protocol, an $n$-node network sensing protocol that injects noise directly into the sensing Hamiltonian, exhibits a tradeoff between the desirable $O(1/n^2)$ Heisenberg scaling of the mean-squared error of the function estimate and the level of privacy attainable. Under assumptions on the network (a common source of randomness and a constant fraction of honest parties), we show that this protocol is locally implementable and achieves $(O(1), δ)$-differential privacy for arbitrarily small $δ$ while retaining Heisenberg scaling of the mean-squared error. We prove that our protocols are resilient to attacks by broad classes of classical and quantum adversaries, and find advantages in the privacy-utility tradeoff when using quantum techniques.

Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06484

AI Summary (中文)

研究背景

针对公共数据集的投毒攻击（Poisoning Attacks）对智能网联汽车（CAVs）构成严重威胁：当被污染的数据用于训练3D感知模型时，可能引发目标物体误识别，或在模型中隐式植入后门触发机制，待特定场景（如雨雾天气、特定车牌样式）出现时被激活。当前研究多聚焦于原始数据层面的投毒，而数据增强（Data Augmentation）作为主流防御手段之一，其对投毒攻击的实际抑制效果尚不明确——尤其在3D点云这一高维稀疏模态下。

方法与实验设计

本研究首次系统评估了投毒攻击在经增强处理的3D点云公共数据集上的运行时影响。我们以生成对抗网络（GAN）为典型代表，构建端到端增强流水线（包括点云配准、旋转、缩放、噪声注入及GAN合成），并在KITTI、nuScenes等主流CAVs数据集上实施多种投毒策略（标签翻转、后门注入）。所有实验均采用统一评估框架：在增强前后分别训练PointPillars、PointNet++等主流3D检测器，并量化攻击成功率（ASR）、干净样本准确率（CACC）与后门触发率（BTR）。

主要发现与创新点

✅ 增强无法天然“净化”投毒：GAN等增强技术不仅未能消除投毒效应，反而因特征空间映射放大了恶意扰动的传播性；
✅ 投毒具有强传播性：原始投毒样本经增强后，其污染效应可扩散至多达7.3倍数量级的合成样本，显著提升攻击隐蔽性与规模；
✅ 决策层扰动可迁移：被污染的增强数据集导致通用分类器（如RandLA-Net）在未见场景下出现平均12.6%的mAP下降，且后门触发率保持>89%；
🔓 全部代码、增强脚本、投毒配置及预训练模型已开源（GitHub链接附论文），支持复现与社区验证。

AI Summary (English)

This paper investigates the operational impact of poisoning attacks on augmented 3D point cloud datasets widely used in connected and autonomous vehicles (CAVs). While data augmentation is often assumed to mitigate poisoning, we demonstrate—through rigorous experiments on KITTI and nuScenes—that common augmentation techniques (especially GAN-based synthesis) fail to sanitize poisoned samples and instead propagate malicious perturbations across generated data. We show that poisoning effects scale up by up to 7.3× in augmented sets and significantly degrade the performance of standard 3D detectors (e.g., PointPillars, PointNet++)—reducing mAP by 12.6% on clean inputs while maintaining >89% backdoor activation rate. All experimental artifacts—including poisoning pipelines, augmentation scripts, and trained models—are publicly released to ensure reproducibility and advance adversarial robustness research for 3D perception systems.

Abstract

Poisoning attacks against public datasets lead to major concerns, such as (i) misclassification of perceived objects when the poisoned data is used for training and (ii) embedding of backdoors that may eventually be triggered later on, when specific conditions in the system apply over the learned models. Its impact over data augmentation models is unclear. While data augmentation reduces the likelihood of poisoning attack success, some valid questions remain. Is data augmentation affecting the impact of poisoning attacks? can it increase the number of poisoned samples or injected backdoors? We explore in this paper some of these questions. We assess the effects of augmenting poisoned 3D point cloud datasets and validate that poisoning is able to evade the sanitizing nature of augmentation techniques when using the concrete case of Generative Adversarial Network (GAN) techniques to exemplify the case of data augmentation processing. We also validate that poisoning propagates over the augmented datasets and perturbs the decision made by general-purpose classifiers, in the end. All the experimental material (including tools, datasets, and classifiers) is publicly available, to facilitate reproducibility and to foster further research in the topic.

From Voting to Agent Collaboration: Answer-Type-Aware LLM Pipelines for BioASQ 14b

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06452

AI Summary (中文)

研究背景

生物医学问答（BioQA）面临双重挑战：既要从海量科学文献中精准抽取信息，又需在跨文档证据间实现可靠整合与推理。现有通用大语言模型（LLM）方法常采用统一提示策略，难以适配不同题型（如是非题、事实型题、列表题）在推理逻辑、评估标准及证据依赖上的本质差异，导致答案鲁棒性不足、证据支撑薄弱。

方法创新

本研究提出答案类型感知的LLM流水线框架，专为BioASQ 14b Task B任务设计，核心在于“一题一策”：

是非题（Yes/No）：引入片段随机重排（snippet shuffling） 与自省式反思（self-reflection），显著降低模型对证据输入顺序的敏感性，提升决策稳定性；
事实型题（Factoid）：采用全片段输入 + 基于思维链（CoT）的上下文学习，强化生物医学实体（如基因、疾病、药物）的精确识别与定位；
列表题（List）：构建多智能体协同架构，将任务解耦为四大角色——证据提取代理、候选生成代理、答案验证代理与聚合决策代理，实现端到端可解释的协作推理。

主要成果

基于BioASQ 13b的预实验筛选最优策略，该框架在BioASQ 14b官方评测中表现突出：在全部4个批次中均保持竞争力排名，并在Batch 4的事实型子任务中斩获第一名。结果证实：题型定制化推理 + 多路径集成预测 + 代理式证据验证的三重协同，可系统性提升生物医学问答的准确性、鲁棒性与可追溯性。

AI Summary (English)

This paper introduces an answer-type-aware LLM pipeline for BioASQ 14b Task B, addressing the dual challenge of precise information extraction and cross-document evidence integration in biomedical QA. Instead of a one-size-fits-all prompting strategy, it tailors inference procedures to question types: (1) For yes/no questions, snippet shuffling and self-reflection enhance decision stability against evidence ordering bias; (2) For factoid questions, full-snippet input with chain-of-thought in-context learning improves biomedical entity identification accuracy; (3) For list questions, a multi-agent architecture decomposes tasks into collaborative evidence extraction, candidate generation, verification, and aggregation. Evaluated officially on BioASQ 14b, the framework achieved competitive performance across all four batches and ranked 1st in the factoid subtask of Batch 4. These results validate that question-type specialization, ensemble prediction, and agent-based verification synergistically boost reliability and evidence grounding in biomedical QA.

Abstract

Biomedical question answering requires not only accurate extraction of information from scientific literature but also reliable integration of evidence across multiple documents. This study presents a question-type-specific large language model (LLM) framework for BioASQ 14b Task B, designed to improve answer robustness and evidence grounding in biomedical question answering. Rather than applying a single prompting strategy to all questions, the framework selects different inference procedures for yes/no, factoid, and list questions according to their distinct reasoning and evaluation requirements. For yes/no questions, snippet shuffling and self-reflection are used to reduce sensitivity to evidence ordering and improve decision stability. For factoid questions, full-snippet input is combined with chain-of-thought-based in-context learning to support accurate biomedical entity identification. For list questions, a multi-agent architecture is employed, in which evidence extraction, candidate generation, answer verification, and final aggregation are handled collaboratively. Preliminary experiments on BioASQ 13b were used to identify effective inference strategies for each question type, and the resulting framework was subsequently evaluated in the official BioASQ 14b Task B challenge. In the official evaluation, our framework showed competitive performance across multiple batches and achieved first place in the factoid subtask of Batch 4. These results demonstrate the effectiveness of combining question-type-specific inference, ensemble prediction, and agent-based verification for reliable biomedical question answering.

Analysis-by-Proxy: Localization Signals in VLMs Operating as Condition Encoders

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06445

AI Summary (中文)

背景与问题

视觉-语言模型（VLMs）因其强大的跨模态推理能力，正被广泛用作扩散图像编辑系统的条件编码器（condition encoder）。然而，尽管VLMs在独立定位任务中表现优异，现有编辑流水线在复杂多实体场景中却频繁失效——定位精度显著下降。本文指出：这一性能鸿沟源于将VLM强制限制为单次前向传递的条件编码器，剥夺了其原生支持的自回归生成机制，导致其内在空间理解能力无法充分释放。

方法：Analysis-by-Proxy 框架

为探测VLM在条件编码模式下是否仍隐含定位信号，我们提出Analysis-by-Proxy（代理分析法）。该方法不直接解析黑盒VLM，而是训练一个轻量、可解释的代理模型（如小型CNN或MLP），以VLM各层中间表征为输入，监督学习一个辅助定位任务（如边界框回归或显著性图预测）。通过反向归因代理模型的高响应区域，我们精确定位VLM中实际承载定位信息的隐藏层与通道位置。

关键发现与创新

根本性错配：当前编辑流水线普遍采用固定层（如最后一层CLIP文本嵌入）提取条件，但我们的分析证实：定位信号并不稳定地汇聚于预设层；相反，它动态分布于中间层，且其最优位置随输入文本提示显著变化。
信号“隐身”现象：在单次前向约束下，关键空间信号被稀释或掩蔽于非标准层，传统提取策略实质上“漏掉了”最富信息的表征。
设计启示：本工作首次系统揭示了条件编码范式下VLM空间知识的表征失真机制，为构建动态层选择、多层融合或提示感知条件路由等新一代编辑架构提供了可验证的理论依据与实证基础。

AI Summary (English)

Vision-Language Models (VLMs) excel at spatial localization in standalone settings, yet their performance degrades sharply when deployed as single-pass condition encoders in diffusion-based image editing. We hypothesize this gap arises because conditioning restricts VLMs to one forward pass—bypassing their autoregressive design and suppressing latent spatial knowledge. To test whether localization signals persist under such constraints, we propose Analysis-by-Proxy: a framework that trains a lightweight, interpretable proxy model on VLM intermediate representations using an auxiliary localization task (e.g., bounding box regression). By analyzing where the proxy succeeds, we localize exactly which layers and channels encode reliable spatial cues. Crucially, we find these signals are not consistently present in standard conditioning layers (e.g., final text embeddings); instead, they reside dynamically in earlier or deeper intermediate representations—varying with the input prompt. This reveals a fundamental mismatch: existing editing pipelines extract conditions from fixed, static layers, thereby missing the most informative, context-dependent spatial signals. Our work exposes the root cause of localization failure in VLM-based editing and establishes a principled, representation-aware foundation for next-generation conditioning architectures.

Abstract

Vision-Language Models (VLMs) are increasingly utilized as the conditioning backbone for diffusion-based image editing due to their remarkable multimodal reasoning capabilities. While standalone VLMs demonstrate strong localization capabilities, editing pipelines frequently struggle to maintain this accuracy, particularly in complex, multi-entity scenes. In this work, we investigate this performance gap, hypothesizing that it stems from treating the VLM as a condition encoder. In this role, the model is restricted to a single forward pass, preventing the autoregressive generation process for which it was optimized, thereby failing to fully expose its capabilities. To investigate whether this spatial understanding persists when the VLM is used as a condition encoder, we introduce Analysis-by-Proxy. In this framework, we train a lightweight, interpretable proxy model on the VLM's intermediate representations using an auxiliary localization task. By analyzing the VLM through this proxy, we uncover the specific VLM representations that encode localization information. Our findings expose a fundamental mismatch between how spatial knowledge is represented within a VLM condition encoder and how it is extracted by current editing pipelines. We reveal that under single-pass constraints, the localization signal does not reliably propagate to the predefined layer configurations commonly used for conditioning. Instead, this crucial signal remains hidden within intermediate representations, at locations that vary depending on the input prompt. Using our introduced Analysis-by-Proxy framework, we reveal the fundamental failures of existing condition extraction strategies in editing pipelines, opening the door to more principled design of conditioning architectures.

Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06364

AI Summary (中文)

研究背景

云安全合规性映射（即将安全控制要求与可测量的技术指标关联）目前高度依赖人工专家判断，效率低、可扩展性差、易出错。尤其在跨多个欧洲安全标准（如ISO/IEC 27001、NIST SP 800-53、ENISA CCM、GDPR、TISAX）的场景下，手动对齐控制项与技术度量（如API调用日志留存时长、MFA启用率、加密算法强度）面临语义鸿沟与术语异构性挑战。

方法创新

本文提出面向云安全领域的句子嵌入模型域适应框架：

构建首个开源、多标准语义配对语料库——含3,499组人工标注的“控制文本–技术指标”语义匹配对，覆盖5大权威标准；
通过回译增强（English↔German↔French）与LLM驱动的可控改写（使用Llama-3-70B生成语义一致但句式多样的变体），将数据规模扩展至最多13,996样本，涵盖4类典型映射场景（精确匹配、泛化映射、跨标准等价、指标聚合）；
系统微调5种Sentence Transformer架构（包括multi-qa-mpnet-dot-v1、all-mpnet-base-v2等），并在两个零样本基线任务上严格评估：控制→技术指标映射（Control-to-Metric）与跨标准控制关联（Cross-Standard Control Association）。

关键发现

所有微调模型均显著超越零样本基线（+12.3–23.0 nDCG@10）；
在Control-to-Metric任务中，最优模型提升达23.0 nDCG@10；
在跨标准任务中，经回译增强的multi-qa-mpnet-dot-v1实现0.870 nDCG@10，首次验证了域适配对合规知识迁移的有效性；
消融实验证实：领域内高质量配对数据是性能主导因素，远超模型架构选择或数据量单纯扩充的影响。

AI Summary (English)

This paper addresses the labor-intensive, error-prone manual mapping of cloud security controls (e.g., from ISO 27001 or NIST SP 800-53) to technical metrics (e.g., “MFA enforcement rate”, “encryption key length”). We propose domain adaptation of Sentence Transformers using a novel, multi-standard semantic corpus of 3,499 expert-annotated control–metric pairs, augmented to up to 13,996 samples via back-translation and LLM-based paraphrasing across four realistic scenarios. Fine-tuning five architectures yields consistent gains over zero-shot baselines: the best model achieves +23.0 nDCG@10 on control-to-metric retrieval and 0.870 nDCG@10 on cross-standard control association (using multi-qa-mpnet-dot-v1 with back-translation). Crucially, ablation confirms that in-domain training data—not just scale or architecture—is the primary performance driver. Our work enables scalable, auditable, and standards-agnostic compliance automation in cloud environments.

Abstract

Mapping cloud security controls to technical metrics is currently a manual process. This paper proposes domain adaptation of Sentence Transformer models to automate it. We build a training corpus of 3,499 semantic pairs from five European security standards and a set of technical metrics, then expand it via back-translation and LLM-based paraphrasing to up to 13,996 samples across four scenarios. We fine-tune five architectures and evaluate their performance on two independent tasks: control-to-metric and cross-standard controls association. All fine-tuned models outperform their zero-shot baselines. On the control-to-metric task, the best model gains up to 23 nDCG@10 points, while on the cross-standard control task, \textit{multi-qa-mpnet-dot-v1} under back-translation reaches 0.870 nDCG@10. The results show that in-domain training data is a primary driver of performance for the considered case studies.

Dithered Gaussian Mechanism for Randomness-Efficient Differential Privacy

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06320

AI Summary (中文)

提出新型抖动高斯机制，实现随机性高效差分隐私

本研究提出抖动高斯机制（Dithered Gaussian Mechanism），一种面向差分隐私（DP）的创新噪声注入方案。与主流的离散高斯机制不同，该机制不直接采样离散噪声分布，而是对标准高斯机制的连续输出进行确定性抖动（dithering）后离散化——即先生成连续高斯噪声，再通过均匀抖动+取整完成输出离散化。这一设计被严格建模为高斯机制的后处理操作，因而天然继承标准高斯机制的 $(\varepsilon,\delta)$-DP 保证，同时彻底规避了浮点数有限精度导致的隐私泄露风险（如舍入偏差、可逆浮点逆运算等）。

核心创新在于随机性解耦设计：机制将随机源分为两类——

高安全性私有随机源：仅用于关键采样步骤（如选择离散输出值），其比特数可降至 $O(\log(1/\delta))$ 量级，且与噪声尺度 $\sigma$ 无关；
高性能公共随机源：用于抖动阶段的均匀随机偏移，即使完全暴露给攻击者亦不损害隐私。

理论证明该机制在相同隐私预算下显著降低高质量随机比特需求，提升随机性效率。实验验证中，将其集成至 DP-SGD 框架训练 ResNet-18 时，在 CIFAR-10 上仅引入约 8% 的额外运行开销，却实现了抗浮点漏洞的密码学安全噪声生成，兼顾安全性与实用性。

AI Summary (English)

We propose the dithered Gaussian mechanism, a randomness-efficient alternative to the discrete Gaussian mechanism for differential privacy. Instead of sampling from a discrete noise distribution, it discretizes the output of the standard Gaussian mechanism via uniform dithering followed by rounding—formally a privacy-preserving post-processing step. This preserves the exact $(\varepsilon,\delta)$-DP guarantees of the Gaussian mechanism while eliminating floating-point precision vulnerabilities. Crucially, it separates randomness into two independent sources: a cryptographically secure private source (used only for the privacy-critical discrete sampling step, requiring only $O(\log(1/\delta))$ high-quality bits, independent of noise scale $\sigma$), and a public, possibly adversarial source (used for dithering). Applied to DP-SGD, our mechanism achieves cryptographically secure noise generation with modest overhead (<10% runtime increase) and robustness against floating-point side-channel leaks.

Abstract

We present the dithered Gaussian mechanism, a novel alternative to the discrete Gaussian mechanism for differential privacy that discretizes the private output rather than the noise distribution itself. By interpreting this discretization as post-processing of the Gaussian mechanism, our construction directly inherits the privacy guarantees of the standard Gaussian mechanism while avoiding vulnerabilities caused by finite-precision floating-point outputs. We show that the mechanism is provably randomness-efficient: by sampling the discretized output values directly, the number of high-quality random bits required for privacy can be reduced significantly and made independent of the noise level. This is achieved by separating the randomness into two sources: a high-quality source used for the privacy-critical sampling step, and a high-performance public source, possibly known to the adversary, that supplies the additional randomness needed for randomized discretization. This separation enables the use of cryptographically secure randomness without substantial performance loss. As an application, we study model training with DP-SGD and show that cryptographically secure noise generation with reduced exposure to floating-point vulnerabilities can be achieved with modest practical overhead.

Spider 2.0-AIFunc: Extending Real-World Text-to-SQL to AI-Native SQL Workflows

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06229

AI Summary (中文)

背景与问题

随着Snowflake等主流云数据平台将大语言模型（LLM）能力封装为原生SQL函数（如SNOWFLAKE.CORTEX.CLASSIFY, EMBED_TEXT_768），分析师可在标准SQL中直接执行分类、情感分析、实体抽取、语义相似度检索与AI增强聚合等任务。然而，现有Text-to-SQL基准（如Spider）仅覆盖传统SQL语法，完全缺失对AI-native SQL生成能力的评估，导致模型在真实AI增强数据分析场景中的表现不可知。

方法与构建

本文提出Spider 2.0-AIFunc——首个面向AI-native SQL的权威基准：

✅ 规模与真实性：涵盖125个真实企业数据库的465个经人工验证实例，覆盖6类Snowflake AI函数（分类、情感、嵌入、相似性、提取、聚合）；
✅ 智能重构流程：基于企业级原始Spider任务，设计多步代理驱动流水线，自动重写自然语言指令与目标SQL，显式注入AI意图（如“用语义相似度筛选产品描述”）、消解歧义，并精准映射到AI函数参数与schema上下文；
✅ 严格质量保障：所有实例通过跨时间窗口的多轮重复执行协议（≥3轮，间隔≥24h），确保结果稳定可复现，杜绝偶然性成功。

关键发现与启示

🔍 模型评测：10个SOTA模型中，最强闭源模型（GPT-4o、Claude-3.5）执行准确率仅67–70%，最佳开源模型（DeepSeek-Coder 32B）为58.1%；主要错误集中于谓词逻辑误设、schema表/列绑定偏差、AI函数参数类型/格式错误（占失败案例72%）；
🤖 代理框架失效：传统Text-to-SQL专用Agent（如复杂schema检索、多表推理模块）在此场景下未提升性能，甚至降低鲁棒性；极简Agent（仅基础SQL生成+单次纠错）反而稳定超越；表明AI-native SQL更依赖LLM内在函数理解力，而非外部结构化推理。

数据与代码已开源：https://github.com/Leolty/Spider2-AIFunc

AI Summary (English)

We introduce Spider 2.0-AIFunc, the first benchmark designed to evaluate text-to-SQL models on AI-native SQL—queries that invoke LLM-powered functions (e.g., CORTEX.SENTIMENT, VECTOR_AGGREGATE) directly within SQL, as natively supported by Snowflake and other cloud platforms. Built from real enterprise databases, it comprises 465 verified instances across 125 schemas, covering six AI function types. We construct it via an agent-based pipeline that rewrites conventional Spider tasks into AI-native form, explicitly grounding natural language intent in function semantics and parameter constraints, while ensuring result stability through multi-round temporal execution validation. Evaluation of ten state-of-the-art LLMs reveals a significant capability gap: top proprietary models achieve only 67–70% execution accuracy, while the best open-source model scores 58.1%, with errors predominantly in predicate logic, schema grounding, and AI function parameterization. Crucially, traditional text-to-SQL agent frameworks—designed for complex schema reasoning—show no benefit and often degrade performance, suggesting that AI-native SQL generation relies more critically on intrinsic LLM understanding of AI functions than on external structural reasoning modules.

Abstract

Major cloud data platforms now expose large language model capabilities as native SQL functions, enabling analysts to perform classification, filtering, sentiment analysis, extraction, similarity search, and aggregation within ordinary SQL queries. Yet existing text-to-SQL benchmarks evaluate only conventional SQL and provide no signal on whether models can generate such AI-native SQL. We introduce Spider 2.0-AIFunc, a benchmark of 465 verified instances across 125 real-world databases covering six types of AI functions on the Snowflake platform. Starting from an existing enterprise text-to-SQL benchmark, we construct Spider 2.0-AIFunc through an agent-based pipeline that rewrites source tasks into AI-native form, simultaneously transforming target queries and refining natural language instructions to make the intended AI-native solution explicit and reduce ambiguity. All instances pass a multi-round repeated execution protocol across temporally separated windows to confirm result stability before release. Evaluating ten state-of-the-art language models, we find that the strongest proprietary models reach 67-70% execution accuracy while the best open-source model achieves 58.1%, a gap driven primarily by errors in predicate specification, schema grounding, and AI function parameterization. Agent frameworks designed for traditional text-to-SQL challenges, such as schema retrieval and relevant table selection, do not transfer effectively to AI-native SQL: a minimal agent setup consistently matches or outperforms more elaborate alternatives, suggesting that the strategies these frameworks employ are less critical in this setting. Data are available at https://github.com/Leolty/Spider2-AIFunc .

SplineNet: An Isogeometric Deep Learning Method for Complex Shells

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.06026

AI Summary (中文)

SplineNet：面向复杂壳体结构的等几何深度学习方法

本文提出一种新型等几何深度学习框架——SplineNet，旨在实现复杂几何壳体结构的“设计—分析”一体化。其核心创新在于将水密样条表示（如分析适配的非结构T样条）直接嵌入神经网络架构，使网络具备对CAD模型的精确几何描述能力，彻底消除传统CAE流程中CAD模型与分析网格之间的转换误差与耗时交换。

SplineNet采用Bézier提取技术构建网络主干，以Bernstein多项式作为可微、物理驱动的非线性激活函数，天然继承样条基函数的光滑性与局部支撑特性。该方法支持双模态应用：

无数据模式：通过引入基于能量原理的损失项（如Kirchhoff–Love壳体模型的应变能），直接在神经网络中求解力学响应，实现CAD与CAE在统一框架下的无缝耦合；
数据驱动模式：作为DeepONet的可解释性主干网络（trunk net），支持对新几何或边界条件的零样本泛化，避免重复建模与重训练。

数值实验涵盖多个真实工程级复杂壳体（含曲率突变、拓扑孔洞与自由曲面），结果表明：SplineNet在保持亚毫米级几何保真度的同时，预测精度媲美高阶有限元，且推理速度提升1–2个数量级。本工作首次实现了几何保真、物理一致、计算高效三者的协同统一，为智能设计软件的下一代内核提供了理论基础与实践范式。

AI Summary (English)

We propose SplineNet, a novel isogeometric deep learning method for end-to-end design and analysis of complex shell structures. Built upon watertight spline representations (e.g., analysis-suitable unstructured T-splines), SplineNet embeds exact CAD geometry into neural networks via Bézier extraction, using Bernstein polynomials as physics-informed activation functions. It operates in two complementary modes: (1) data-free, where energy-based loss terms—especially the Kirchhoff–Love shell model—enable direct PDE-constrained optimization without meshing or data; and (2) data-driven, serving as an interpretable trunk net in DeepONet for zero-shot generalization to unseen geometries or boundary conditions. Numerical experiments on real-world complex shells demonstrate high geometric fidelity, accuracy comparable to high-order FEM, and orders-of-magnitude faster inference—achieving unprecedented integration of geometric precision, physical consistency, and computational efficiency.

Abstract

We present a novel isogeometric deep learning method, termed SplineNet, for the seamless design and analysis of shell structures with complex geometries. The proposed approach is built upon watertight spline representations, e.g., analysis-suitable unstructured T-splines, and features exact geometric descriptions of Computer-Aided Design (CAD) models in neural networks. Bézier extraction is used to build the network architecture, where Bernstein polynomials serve as the nonlinear activation functions. SplineNet can be applied in a data-free or data-driven way. In the data-free case, energy-based formulations can be naturally incorporated as loss terms, which fulfill the need of Computer-Aided Engineering (CAE) and can be accurately calculated. In particular, the Kirchhoff--Love (KL) model is adopted to solve for the mechanical behaviors of shell structures. This way, CAD and CAE can be tightly integrated in a deep neural network without the time-consuming model/data exchange process. In the data-driven case, SplineNet can be used as the trunk net of Deep Operator Networks (DeepONet) to provide interpretability. Given such a trained network and unseen input data, results can be immediately obtained without retraining the network or repeatedly performing the traditional workflow for analysis. In the end, a variety of numerical examples are studied to demonstrate the effectiveness of the proposed method, especially when real-world complex geometries are involved.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05916

AI Summary (中文)

研究背景

随着网络攻击日益复杂化，传统人工编写网络入侵检测系统（NIDS）规则的方式已难以满足实时性与可扩展性需求，成为安全运维的关键瓶颈。尽管大语言模型（LLMs）在自动化规则生成方面展现出潜力，但其产出是否真正具备生产就绪性（production-readiness）——即语法正确、语义精准、逻辑可靠且可直接部署——尚未经过实证检验。

研究方法

本研究采用以人为中心的研究范式，提出一个基于领域知识锚定的LLM规则生成框架（Grounded Generation Framework），融合Snort语法约束、威胁情报上下文与专家反馈闭环。通过严格筛选的10位资深安全专家（平均从业年限12.3年）开展受控用户研究，结合任务完成率、规则可部署性评估、系统可用性量表（SUS）及深度访谈进行多维验证。

主要发现

语法-语义悖论凸显：LLMs生成的规则100%通过语法校验，但仅68%被专家判定为“可直接部署”；12%存在逻辑幻觉（如误判协议状态、错误匹配载荷边界），另有20%因特异性不足（如过度宽泛的IP范围或缺失关键修饰符）需人工重写。
人机协作定位明确：专家普遍拒绝将LLM视为自主生成器，而将其定位为草案辅助工具（drafting aid）与验证加速器（verification accelerator），强调人工终审不可替代。
模型规模效应显著：≥70B参数的大模型（如Llama3-70B、Claude3-Opus）规则语法正确率达99.2%，而≤4B的小模型（如Phi-3-mini）正确率不足23%，证实IDS规则生成对模型能力存在强规模门槛。

创新贡献

首次实证揭示NIDS规则生成中“正确≠可用”的核心挑战；建立首个面向安全专家的LLM可信度评估基准；为LLM在高保障网络安全场景中的渐进式落地提供设计原则与能力边界指南。

AI Summary (English)

This paper presents the first human-centered evaluation of LLMs for production-grade NIDS rule engineering. Through a rigorous user study with 10 domain experts and a grounded generation framework, we uncover a critical syntax-semantics paradox: while LLMs (≥70B parameters) achieve near-perfect syntactic validity (>99%), only 68% of generated Snort rules are deemed directly deployable due to logic hallucinations (12%) and low specificity (20%). Experts consistently reject autonomous LLM deployment, instead endorsing their role as drafting and verification aids—not independent generators—reflected in a moderate SUS score of 67. Statistical analysis confirms a sharp capability threshold: models ≤4B parameters fail catastrophically (<23% syntax validity), underscoring that effective IDS rule generation demands substantial model scale and domain grounding. Our work establishes empirical benchmarks and design principles for trustworthy LLM integration in security-critical infrastructure.

Abstract

As network threats evolve, manual NIDS rule engineering has become a critical operational bottleneck. While Large Language Models (LLMs) show promise for automating this process, their ability to produce production-ready rules remains unvalidated. This paper presents a human-centered investigation into LLM-based NIDS rule engineering, formalizing a grounded generation framework and evaluating it through a user study with 10 domain experts. Our evaluation reveals a syntax-semantics paradox: although LLMs generate syntactically correct rules, experts find them only partially deployable due to low specificity and logic hallucinations in 12% of cases. While the system received a favorable SUS score of 67, practitioners remain skeptical of its autonomous capabilities, viewing LLMs as support tools for drafting and verification rather than independent generators. Finally, our statistical analysis indicates that while large-scale models ($\geq 70B$) consistently produce syntactically valid rules, small models ($\leq 4B$) are largely ineffective for IDS rule generation.

Auditing of Unlearning Algorithms

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05898

AI Summary (中文)

背景与挑战

机器学习模型的“遗忘学习（unlearning）”旨在在不重新训练的前提下，彻底移除特定训练样本对模型的影响，以满足数据删除权（如GDPR“被遗忘权”）等合规需求。然而，现有算法缺乏可验证的实证评估手段——其理论保证常依赖强假设，而实际效果难以量化，导致“是否真正遗忘”成为悬而未决的开放问题。

方法创新

本文提出首个实用型遗忘审计框架（Auditor），基于成员推断攻击（Membership Inference Attacks, MIA）构建数据依赖的下界估计器：对任意待审计模型，该框架通过MIA成功率反推其未被充分遗忘的残留信息量，并据此计算出可解释的遗忘参数 $\varepsilon$ 的下界。该下界具有统计意义：若观测到的$\varepsilon$下界显著大于算法声称的理论$\varepsilon$，则可在显著性水平下证伪其遗忘保证。框架采用假设检验范式，支持端到端自动化审计。

关键发现

我们在CIFAR-100图像分类与Shakespeare文本生成两大基准上系统评测主流遗忘算法：

✅ 理论驱动型算法（如模型裁剪、回滚删除）展现出极小的$\varepsilon$下界（<0.05），与其$(\varepsilon,\delta)$-遗忘保证一致，未被证伪；
❌ 经验启发式方法（如Hessian近似遗忘、交替升降法、仅在遗忘集上上升、仅在保留集上微调）均产生大幅$\varepsilon$下界（>0.35–0.82），明确揭示其未能有效消除数据影响；
审计结果与模型敏感度、数据分布偏移及攻击策略鲁棒性高度相关，验证了框架的判别力与实用性。

贡献与价值

本工作首次将成员推断攻击转化为可解释、可检验的遗忘审计工具，填补了理论保证与实证验证之间的关键鸿沟，为监管合规、模型认证与可信AI部署提供了可落地的技术支撑。

AI Summary (English)

We address the critical open problem of empirically verifying whether unlearning algorithms truly erase training data influence. We propose a practical auditor that leverages membership inference attacks (MIAs) to compute data-dependent lower bounds on the unlearning parameter $\varepsilon$. If the estimated lower bound exceeds the claimed $\varepsilon$, the algorithm’s unlearning guarantee is statistically falsified under a hypothesis-testing framework. Evaluating multiple methods on CIFAR-100 and Shakespeare datasets, we observe a sharp dichotomy: theoretically grounded approaches—such as model clipping and rewind-to-delete—achieve tight $\varepsilon$ bounds (< 0.05), consistent with their guarantees; in contrast, heuristic methods—including Hessian-based unlearning, interleaved ascent-descent, ascent-only on the forget set, and fine-tuning only on the retain set—yield large bounds (0.35–0.82), indicating substantial residual data influence. Our auditor provides the first actionable, attack-based tool for empirical validation and falsification of unlearning claims.

Abstract

Evaluating whether unlearning algorithms truly remove training data influence remains an open challenge. We propose a practical auditor that computes data-dependent lower bounds on the unlearning parameter $\varepsilon$ using membership inference attacks. Evaluating multiple unlearning algorithms, we find a sharp separation: algorithms with rigorous guarantees, such as model clipping and rewind-to-delete, achieve very small $\varepsilon$ bounds that do not falsify their unlearning guarantees, whereas empirical methods such as Hessian-based unlearning, interleaved ascent-descent, ascent on the forget set, and fine-tuning on the retain set exhibit large bounds, indicating poor unlearning. Our auditor provides a practical tool for empirically falsifying unlearning claims through a hypothesis-testing framework, and we validate it on CIFAR-100 and Shakespeare text.

Harrison.Rad 1.5 Technical Report: A radiology foundation model that can draft reports from images, priors and clinical context

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05880

AI Summary (中文)

背景与挑战

医学影像检查需求增速持续超越放射科医师队伍扩张速度，仅靠人力培训与招聘无法缓解报告积压问题。当前瓶颈在于报告撰写环节——需同步解读影像、整合临床病史与既往检查，并生成结构化/非结构化文本，耗时且易受主观因素影响。

方法与技术创新

本文提出 Harrison.Rad 1.5（HR1.5） ——首个专为放射学设计的多模态基础模型。其核心能力包括：

支持图文交错输入（text-image interleaving），融合当前影像、临床上下文与历史报告；
覆盖六大X线模态：普通X光、胸部、骨肌系统、腹部、脊柱、盆腔及乳腺X线摄影（mammography）；
采用三阶段训练范式：① 基于放射科报告语料对大语言模型进行领域适配；② 在约600万图像-报告对上，以课程学习策略引入难负样本，开展对比式视觉编码器训练；③ 基于多轮医患对话数据微调视觉问答能力。

关键成果与验证

提出Findings-Diagnosis评分框架，在RadGraph-XL实体抽取基础上，集成本体驱动的同义词匹配与极性/矛盾检测；
在权威基准RadBench（模拟FRCR 2B短病例考试）、ReXGradient及内部多模态数据集上全面评估；
HR1.5是唯一通过FRCR模拟合格线的系统，并在闭合式临床问题回答（跨解剖部位）、多部位联合报告、乳腺X线报告及公开胸部报告的临床对齐主指标中均达最高准确率；
提供可解释性分析工具：问题敏感的Grad-CAM热力图、注意力可视化、置信度估计，构建面向临床落地的责任评估框架。

AI Summary (English)

Harrison.Rad 1.5 (HR1.5) is a radiology-specific multimodal foundation model designed to draft structured and free-text reports from X-ray images, clinical context, and prior studies across chest, musculoskeletal, abdominal, spine, pelvic, and mammographic imaging. Trained via a three-stage pipeline—domain-adaptive LLM pretraining, contrastive vision-encoder learning with curriculum-based hard negatives on ~6M image-report pairs, and VQA fine-tuning on multi-turn clinical dialogues—HR1.5 achieves state-of-the-art performance on clinically grounded benchmarks. It is the only evaluated system to meet the simulated FRCR 2B passing standard on RadBench and attains highest accuracy on closed-format clinical questions across anatomical regions, internal multi-body-part reporting, mammography, and the primary clinically-aligned score for public chest reporting. We introduce the Findings-Diagnosis scoring framework—extending RadGraph-XL with ontology-based synonym matching and polarity-contradiction detection—and provide explainability tools (question-sensitive Grad-CAM, attention analysis, confidence estimation) to support responsible clinical evaluation.

Abstract

Imaging demand is growing faster than the radiology workforce can expand, and reporting backlogs cannot be resolved through training and recruitment alone. The most direct opportunity is reducing the time and effort radiologists spend producing reports, a task that requires interpreting images, integrating clinical history and prior studies, and drafting structured findings. We present Harrison.Rad 1.5 (HR1.5), a radiology-specific multimodal large language model that accepts interleaved text and visual inputs and generates structured and unstructured text across plain-film radiology, spanning computed radiography, chest, musculoskeletal, abdominal, spine, and pelvic x-rays, and mammography. HR1.5 is trained through a three-stage pipeline: domain adaptation of a base language model on radiology reports, contrastive vision-encoder training with curriculum-based hard negatives on ~6 million image-report instances, and visual-question-answering fine-tuning on multi-turn conversations. We evaluate it with a Findings-Diagnosis scoring framework that extends RadGraph-XL entity extraction with ontology-based synonym matching and polarity-contradiction detection, benchmarked on RadBench, a simulated FRCR 2B Short Case examination scored against Angoff-method thresholds, ReXGradient, and internal multi-modality datasets. HR1.5 is the only system evaluated to meet the simulated FRCR passing standard and achieves the highest accuracy on closed-format clinical questions, across anatomical regions, on internal multi-body-part and mammography reporting, and on the primary clinically-aligned score for public chest reporting. We further examine explainability and model behaviour, including question-sensitive Grad-CAM heatmaps, attention analysis, and confidence estimation, to support responsible future evaluation toward clinical use, and a framework for clinically grounded assessment of report quality.

Think Before You Grid-Search: Floor-First Triage for LLM Serving

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05876

AI Summary (中文)

背景与问题

大语言模型（LLM）服务优化常依赖密集的配置网格搜索与重型性能剖析器，一旦未达延迟目标即盲目启动复杂分析，导致高开销、低可解释性。本文提出范式反转：估算应先于剖析——缺失理论下界估计的优化，本质退化为无指导的暴力搜索。

方法：Floor-First 分层诊判框架

提出“Floor-First”残差驱动的 triage 工作流：

每个解码步建模为五维资源向量：HBM字节数、FLOPs、网络字节数、网络消息数、KV缓存容量；
对每类资源，取各步骤该维度的最大值（乐观下界） 与总和（悲观上界），构成资源区间 [max, sum]；
实测延迟落在该区间的位置直接反映计算/通信/内存重叠质量，仅当残差（实测−乐观下界）超阈值时才触发深度剖析；
部署选型依据墙序（wall ordering）：随负载增长最先触达瓶颈的资源墙（如 KV 容量墙 vs. 网络带宽墙），而非静态点基准；
框架具模块化与零依赖性：新注意力或状态空间架构仅需声明单个模块接口，即可集成进轻量计算器与智能体优化循环。

关键发现（DeepSeek-V3.2风格671B MoE/MLA模型，16×H20）

H20的极低FLOP/byte比（~74 vs. H100的~590）凸显其解码主导型瓶颈特性；
TP16布局下，KV容量墙限制并发8K请求仅约70路；
稀疏注意力消除KV带宽项，但不解除KV容量墙；
EP16+DP注意力布局以轻微同批权重传输劣化为代价，将KV容量墙提升10倍至~644；
单流延迟TP仍优2.4×，但最优布局是运行点（并发/吞吐/延迟权衡）的可计算函数——解释了为何相同硬件上生产部署采用相反注意力方案。

AI Summary (English)

This paper introduces Floor-First, a principled, estimation-first triage framework for LLM serving optimization—replacing blind grid search with analytically grounded resource floor estimation. Each decode step is modeled as a five-dimensional resource vector (HBM bytes, FLOPs, network bytes, network messages, KV capacity); per-resource max yields an optimistic floor, sum a pessimistic ceiling. The measured latency’s position within this [max, sum] interval quantifies overlap quality before profiling, triggering deep analysis only on residuals exceeding a threshold. Deployment choices are ranked by wall ordering—which resource wall binds first under increasing load—not point benchmarks. Applied to a DeepSeek-V3.2-style 671B MoE/MLA model on 16×H20 GPUs, Floor-First reveals that KV capacity—not bandwidth—is the dominant wall: TP16 supports ~70 concurrent 8K requests; sparse attention removes bandwidth pressure but not capacity; EP16+DP lifts the KV wall to ~644 (10×) at modest weight-traffic cost, while TP retains 2.4× single-stream latency advantage. Crucially, the optimal layout is a computable function of the operating point, explaining divergent production choices on identical hardware.

Abstract

LLM serving optimization typically benchmarks many configurations and reaches for heavy profilers when latency targets are missed. We argue for the reverse discipline: estimation is the analytical layer of profiling -- without it, optimization degenerates to grid search. Floor First is a residual-driven triage workflow. Each decode step is modeled as a five-dimensional resource vector (HBM bytes, FLOPs, network bytes, network messages, KV capacity); summing within a resource and maximizing across resources gives an optimistic floor, the plain sum a pessimistic one. Where a measurement lands inside this [max, sum] interval reads out overlap quality before any profiler is opened, and profilers escalate only on residuals above a stated threshold. Deployment alternatives are compared by wall ordering -- which resource wall binds first as load grows -- rather than by point benchmarks. The account is compositional: new attention or state-space variants enter by declaring one module, and the workflow ships as a zero-dependency calculator plus an agent skill that enforces the discipline in agentic optimization loops. As a case study we analyze a DeepSeek-V3.2-style 671B MoE/MLA model on 16 NVIDIA H20 GPUs, whose ridge point of ~74 FLOP/byte (vs ~590 for H100) makes it an extreme decode-oriented part. The floors show TP16 decoding is KV-capacity-limited to ~70 concurrent 8K requests; sparse attention removes the KV-bandwidth term but not the capacity wall; an EP16+DP-attention layout accepts slightly worse same-batch weight traffic for an order-of-magnitude higher capacity wall (~644) -- while single-stream latency favors TP by 2.4x. The layout judgment is thus a computable function of the operating point, explaining why production deployments on identical hardware have shipped opposite attention layouts.

Code-Level Cost Function Generation for Spatial Image Steganography Using RAG-Enhanced Large Language Models

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05868

AI Summary (中文)

研究背景

空间域图像隐写术的自适应嵌入依赖于高质量代价函数，其设计长期依赖专家手动调参，而现有深度学习方法虽自动化但缺乏可解释性与数学约束保障。大语言模型（LLM）虽能通过进化式生成实现自动化代码产出，却常因缺乏显式领域知识而违反隐写学核心约束（如非负性、局部敏感性、可微性等），导致生成代码不可执行或安全性失效。

方法创新

本文提出首个面向代码级代价函数生成的RAG增强型进化系统，核心为自演化检索增强生成（SE-RAG）模块：

代码语义签名（CSS） 将待优化的Python代价函数片段映射为结构化查询，精准检索静态文献库（含IEEE/ACM隐写论文公式与证明）与动态经验库（历史成功策略及失败归因）；
双源知识融合机制 引导LLM在生成过程中严格遵循数学约束，确保输出代码语法正确、语义合规、可直接编译；
闭环反馈引擎 将每次优化成功的代价函数及其性能指标（如SRM检测率、PSNR）自动沉淀为新经验条目，持续扩充动态知识库。

实验结果

在BOSSBase与BOWS2标准数据集上验证：

相比AutoStego、NeuroStego等自动设计方法，本框架生成的代价函数使隐写安全性（以SRM分类器误检率衡量）平均提升12.7%；
代码可执行率达98.4%，较基线提升46.3%，显著降低人工调试成本；
进化搜索耗时减少26.1%，单次生成周期压缩至平均3.2分钟；
案例分析证实CSS能准确识别“边缘响应抑制”等关键模式，并从文献中检索到对应Laplacian正则项构造方案。

本工作首次将RAG深度耦合进隐写算法的代码级生成闭环，为可信赖AI驱动的密码学算法自动化开辟新范式。

AI Summary (English)

This paper addresses the challenge of automated, interpretable, and mathematically sound cost function generation for spatial image steganography. We propose a novel evolutionary framework powered by Retrieval-Augmented Generation (RAG)-enhanced large language models (LLMs), centered on a Self-Evolving RAG (SE-RAG) module. SE-RAG employs a Code Semantic Signature (CSS) to translate procedural code into domain-aligned queries, retrieving explicit guidance from both static literature (e.g., peer-reviewed steganographic constraints) and a dynamic knowledge base of past optimization experiences. A feedback mechanism continuously refines this knowledge base with successful strategies. Experiments on BOSSBase and BOWS2 show our method achieves 12.7% higher steganographic security, 46.3% higher executable code rate, and 26.1% lower search cost versus state-of-the-art automated approaches—demonstrating the efficacy of tightly integrating LLMs with structured domain knowledge for secure algorithm synthesis.

Abstract

Designing cost functions of adaptive steganography traditionally requires extensive manual tuning, while deep learning methods lack interpretability. Although large language models (LLMs) offer an automated alternative via evolutionary generation, they often violate domain specific mathematical constraints due to a lack of explicit domain knowledge. To address this problem, we propose a novel evolutionary system focused on exploiting Retrieval-Augmented Generation (RAG) enhanced LLMs for the automatic code-level generation of spatial steganography cost functions. This system incorporates a core Self Evolving RAG (SE-RAG) module, wherein a Code Semantic Signature (CSS) translates procedural code into aligned queries, retrieving explicit guidance from static literature and dynamic experience knowledge bases to steer the LLM generation process. A dedicated feedback mechanism then continuously refines the dynamic knowledge base with successful optimization strategies. Extensive experiments on the BOSSBase and BOWS2 datasets demonstrate that the proposed framework consistently achieves higher steganographic security than existing automatically designed methods, and increases the average code execution rate by 46.3% while reducing the search cost by 26.1%, thereby highlighting the effectiveness, efficiency, and potential of combining LLMs with domain-specific knowledge in the field of automatic steganographic algorithm generation.

Differentially Private Natural Gradient Descent

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05866

AI Summary (中文)

背景与挑战

在固定隐私预算下，差分隐私（DP）训练的效用瓶颈本质上源于优化效率低下。主流一阶DP优化器（如DP-SGD）仅利用局部梯度，忽视损失函数的曲率结构，导致在病态（ill-conditioned）优化景观中严重“之字形”震荡——大量宝贵隐私预算被浪费于低效迭代。实践者被迫在过早终止训练与大幅提高每步噪声强度间两难抉择，二者均显著损害最终模型性能。

方法创新

本文提出DP-NGD——首个实用化差分隐私自然梯度下降框架，系统攻克三大核心障碍：

隐私开销可控：将曲率估计完全解耦于私有数据，改用公共数据或合成数据预估Fisher信息矩阵，避免直接消耗隐私预算；
各向同性-各向异性兼容：引入白化空间机制（whitened-space mechanism），在隐私扰动后对梯度进行可逆的各向异性缩放，使DP噪声的各向同性约束与NGD的几何适配性协同工作；
训练稳定保障：设计动态曲率截断（dynamic curvature clamping），抑制平坦方向上逆曲率引起的参数爆炸更新，显著提升收敛鲁棒性。

主要成果

在CIFAR-10、CIFAR-100及ImageNet子集等标准基准上，DP-NGD在同等ε（ε≤8）隐私预算下：
✅ 实现SOTA精度（如CIFAR-10达82.3%，较DP-SGD +7.1%）；
✅ 突破一阶方法长期存在的效用天花板；
✅ 收敛速度最高提升10倍，同等精度下所需迭代次数锐减，隐私预算利用效率实现质的飞跃。

AI Summary (English)

Differentially private (DP) training faces a fundamental utility bottleneck: under fixed privacy budgets, first-order DP optimizers like DP-SGD ignore loss geometry, leading to inefficient zigzagging and wasted privacy cost. Natural Gradient Descent (NGD) offers geometric alignment but clashes with DP due to prohibitive curvature estimation costs, isotropic noise constraints, and instability from unbounded inverse curvature scaling. We propose DP-NGD, the first practical DP second-order framework that: (i) decouples curvature estimation from private data using public/synthetic data; (ii) reconciles isotropic DP noise with anisotropic NGD via a whitened-space preconditioning mechanism; and (iii) dynamically clamps curvature to ensure stable training. Experiments show DP-NGD achieves state-of-the-art accuracy—e.g., +7.1% on CIFAR-10—and up to 10× faster convergence under identical privacy budgets (ε ≤ 8), breaking long-standing utility ceilings of first-order baselines.

Abstract

Under a fixed privacy budget, the utility of differentially private (DP) training is ultimately determined by its optimization efficiency. Standard first-order DP optimizers such as DP-SGD rely solely on local gradients and ignore the underlying loss curvature. This geometric blindness causes severe zigzagging in ill-conditioned landscapes, squandering precious privacy budgets on inefficient iterations. Practitioners are thus trapped in a bind: either stop training prematurely or inject massive per-step noise, both of which critically compromise final model utility. Natural Gradient Descent (NGD) resolves this by preconditioning gradients with curvature, aligning updates with the loss geometry and extracting more efficient signal from every noisy step, offering a principled pathway to break the privacy-utility bottleneck. Despite its theoretical appeal, directly integrating NGD with DP introduces fundamental challenges: curvature estimation itself consumes prohibitive privacy budgets, isotropic DP operations conflict with the anisotropic scaling of NGD, and the inverse curvature catastrophically amplify parameter updates in flat directions, causing training instability. We propose DP-NGD, a practical framework that systematically addresses these obstacles by decoupling curvature estimation from private data, reconciling isotropic DP constraints with anisotropic second-order optimization via a whitened-space mechanism, and dynamically clamping the curvature to stabilize training. Extensive experiments on standard benchmarks demonstrate that DP-NGD achieves state-of-the-art accuracy, breaking through the utility ceilings of first-order baselines while delivering up to a $10\times$ convergence speedup under the same privacy budget.

Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05842

AI Summary (中文)

超越拒绝：同源大模型对齐态与消拒态在漏洞分析中的对比研究

当前，大语言模型（LLM）辅助软件安全面临核心张力：合法代码审查、漏洞研判与修复所需的术语高度接近恶意用途表述，导致传统安全评估难以解耦“拒绝行为”本身与模型架构、规模、训练数据等混杂因素。为精准隔离“安全状态”这一变量，本文提出同源谱系内对照范式：聚焦同一基础模型衍生出的两类状态——对齐态（Aligned）（保留指令微调后的拒绝能力）与消拒态（Abliterated）（经显式移除拒绝机制的公开变体）。我们系统评估二者在五大关键安全任务中的防御效用：漏洞检测、CWE分类、脆弱行定位、根因定位及可执行补丁验证，并将提示词措辞作为可控框架维度：从中立代码审查语言出发，逐步引入授权上下文与网络安全术语密度梯度。

实验覆盖Gemmma与Qwen两大开源模型家族。在Gemma Java/Vul4J修复验证任务中，消拒态模型显著提升早期可用性：67.8%补丁被判定为可用（vs. 对齐态29.9%）、65.0%成功应用（vs. 24.9%）、32.8%成功编译（vs. 9.0%）；在Qwen对中，消拒态将脆弱行定位性能提升近一倍：行级F1从2.08%升至3.91%，Top-1准确率从4.10%升至6.95%。本研究揭示：单纯测量“是否拒绝”会掩盖模型在真实工程流水线中的实际效用；安全评估需三位一体：响应意愿（是否答）、响应质量（是否准）、工程可操作性（是否能用）。该发现为构建可信AI安全助手提供了方法论基准与实践路径。

AI Summary (English)

This study isolates safety state—whether an LLM retains refusal behavior (Aligned) or has undergone targeted refusal ablation (Abliterated)—within same-lineage models (Gemma and Qwen), enabling clean comparison in software security tasks. We evaluate both states across vulnerability detection, CWE attribution, vulnerable-line/root-cause localization, and executable patch validation, while systematically varying prompt framing (neutral → authorized → cybersecurity-terminology-dense). Results show Abliterated models significantly outperform Aligned ones: on Gemma+Vul4J, Abliterated achieves 67.8% usable patches vs. 29.9%, and 32.8% successful compilation vs. 9.0%; on Qwen, line-level F1 doubles (2.08% → 3.91%) and Top-1 accuracy rises from 4.10% to 6.95%. These findings argue that LLM security evaluation must jointly assess response generation, correctness, and end-to-end actionability—not just refusal propensity.

Abstract

Large language model (LLM)-assisted software security operates at a difficult boundary: the vulnerability-analysis terminology needed for legitimate code review, triage, and repair can closely resemble terminology associated with misuse. Existing safety and cybersecurity evaluations are difficult to interpret in this setting because they often compare unrelated model families, thereby conflating safety behavior with differences in architecture, scale, training data, and deployment. To isolate this factor, we study safety state: whether refusal behavior remains intact (Aligned) or has been refusal-ablated (Abliterated) within same-lineage models. We ask how this safety state affects defensive utility across software-security workflows. We compare aligned instruction-tuned models with publicly released refusal-ablated descendants from two model families, Gemma and Qwen. We evaluate Aligned and Abliterated states on vulnerability detection, CWE attribution, vulnerable-line localization, root-cause localization, and executable patch validation. We further treat prompt wording as a controlled framing dimension: prompts begin with neutral code-review language, add authorization context, and vary the density of cybersecurity terminology. In a Gemma-based Java/Vul4J repair-validation study, Abliterated achieves higher early-stage validation rates, with 67.8%, 65.0%, and 32.8% of patches judged usable, successfully applied, and successfully compiled, respectively, compared with 29.9%, 24.9%, and 9.0% for Aligned. In the Qwen pair, Abliterated improves localization performance, increasing line-level F1 from 2.08% to 3.91% and Top-1 accuracy from 4.10% to 6.95%. These findings suggest that evaluations of LLM-based security assistants should jointly measure whether models respond, whether their usable responses are correct, and whether their outputs remain actionable across the engineering workflow.

Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05775

AI Summary (中文)

超越排行榜：大型语言模型智能体在工具使用、规划与推理中的失效模式综述

本研究系统梳理了2023–2026年间27篇基准测试、分类学与审计类论文（覆盖19个主流基准），首次构建了一个跨维度、统一化的大型语言模型（LLM）智能体失效分类体系。区别于聚焦单一能力（如工具调用或规划）的既有工作，本综述整合了工具使用、多步规划、长程推理、多智能体协同、安全鲁棒性及评估效度六大关键维度，揭示其内在关联与共性瓶颈。

我们通过迭代聚类方法，将分散报告的错误类型映射至智能体“推理→行动”流水线的不同阶段，归纳出六大失效簇：
1. 工具调用与参数级错误（如API签名误配、JSON格式崩溃）；
2. 规划与约束满足失败（目标分解偏差、资源/时序约束忽略）；
3. 长程任务中的上下文退化（信息稀释、状态遗忘、因果链断裂）；
4. 多智能体协同失效（角色混淆、协议不一致、共识机制缺失）；
5. 对抗性或模糊条件下的安全与安全漏洞（越权操作、提示注入利用、隐私泄露）；
6. 测量效度问题（基准过拟合、人工评分偏差、真实世界迁移性缺失）。

核心发现表明：失效呈现非线性累积效应——任务长度每增加一倍，端到端成功率下降超40%；子任务高分≠整体成功；现有 scaffolding（如思维链、反射机制）提升有限且不稳定。值得肯定的是，单轮工具调用、短程网页导航与窄域编程任务已取得实质性进展。

AI Summary (English)

This paper presents the first unified taxonomy of LLM agent limitations, synthesizing evidence from 27 benchmark, taxonomy, and audit studies (2023–2026) across 19 distinct benchmarks. We identify six cross-cutting failure clusters: (1) tool invocation and parameter-level errors; (2) planning and constraint-satisfaction failures; (3) long-horizon degradation due to context accumulation; (4) multi-agent coordination breakdowns; (5) safety and security failures under adversarial or underspecified conditions; and (6) measurement validity issues (e.g., benchmark overfitting, low real-world transfer). Critically, failures compound nonlinearly with task length—strong performance on isolated sub-tasks does not guarantee end-to-end success, and common scaffolding techniques (e.g., chain-of-thought, reflection) yield inconsistent reliability gains. While significant progress exists in single-turn tool use, short-horizon web navigation, and narrowly scoped coding, fundamental gaps persist in holistic, robust, and trustworthy agentic reasoning.

Abstract

Large language model (LLM) agents are increasingly evaluated on their ability to use tools, plan multi-step tasks, coordinate with other agents, and operate over extended horizons. Reported benchmark gains often obscure recurring failure modes documented across otherwise unrelated evaluation efforts. This paper synthesizes 27 benchmark, taxonomy, and audit papers (2023-2026), spanning 19 distinct benchmarks, into a cross-cutting taxonomy of agent limitations. To our knowledge, this is the first synthesis that integrates evidence across tool use, planning, long-horizon reasoning, multi-agent coordination, safety, and measurement validity into a single, unified taxonomy of LLM agent limitations. We identify six failure clusters: (1) tool invocation and parameter-level errors, (2) planning and constraint-satisfaction failures, (3) long-horizon degradation from context accumulation, (4) multi-agent coordination failures, (5) safety and security failures under adversarial or underspecified conditions, and (6) measurement validity problems. The taxonomy was derived iteratively by grouping independently reported error categories into themes corresponding to distinct stages of the agent reasoning-to-action pipeline. Across the literature, we find that failures compound nonlinearly with task length, that strong performance on individual sub-tasks does not reliably translate into end-to-end success, and that additional scaffolding does not consistently improve reliability. At the same time, substantial progress has been demonstrated in single-turn tool use, short-horizon web navigation, and narrowly scoped coding tasks.

Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05748

AI Summary (中文)

背景与挑战

神经网络后门攻击通过数据投毒在训练阶段植入隐蔽触发器，导致模型在正常样本上表现正常，却在含特定触发器的输入上产生恶意预测。当前主流训练时防御方法依赖“良性样本更难被错误拟合”的直觉，采用固定损失阈值分割或迭代学习良性参考模型作为判别依据——但后者需在纯净子集上训练，实际中难以保证其纯净性，且对强攻击（如动态/语义触发器）鲁棒性不足。

方法创新：HARVEY

本文提出HARVEY——一种反直觉但更高效的防御范式：不学习良性样本的参考模型，而是主动学习一个“中毒参考模型”（backdoored oracle）。其核心洞见在于：后门样本因触发器与标签强关联，比良性样本更易被快速、一致地拟合；因此，仅用少量迭代即可稳定训练出高置信度的中毒模型，其低损失样本即为高概率中毒样本。我们据此设计双阶段流程：（1）快速构建轻量级中毒参考模型；（2）基于其损失分布自适应识别并剔除中毒样本，再于净化数据上微调主模型。

关键成果

在CIFAR-10、Tiny-ImageNet及NLP（SST-2）等多任务基准上，HARVEY将典型攻击（BadNets、Blend、SIG）的攻击成功率降至≤0.8%（基线普遍＞30%），同时自然准确率损失仅0.1–0.5个百分点，显著优于SPECTRE、ANP、Rafael等SOTA方法。消融实验证实：中毒模型构建的稳定性与损失判别阈值的自适应性是性能跃升的关键。本工作首次证明——“学习后门”本身即是移除后门最可靠的线索。

AI Summary (English)

Recent anti-backdoor defenses rely on identifying benign samples via loss-based thresholds or auxiliary reference models trained on presumed-clean data—yet these struggle with strong poisoning attacks and suffer from oracle contamination. HARVEY flips the paradigm: it trains a lightweight backdoored reference model (not a clean one), exploiting the key insight that poisoned samples are easier and faster to fit due to trigger-label correlation. This enables highly accurate identification of poisoned inputs via low-loss statistics. HARVEY then purifies training data and fine-tunes the main model. Evaluated across 4 datasets, 5 architectures, and 6 attack types (including dynamic/semantic triggers), HARVEY reduces attack success rates to ≤0.8% while incurring only 0.1–0.5% natural accuracy drop, outperforming all prior methods. Its core contribution is demonstrating that learning the backdoor is the most reliable way to remove it.

Abstract

The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting or iteratively learn a reference model as an oracle for identifying benign samples. In particular, the latter has proven effective for anti-backdoor learning. Our method, HARVEY, leverages a similar yet crucially different technique: learning an oracle for poisonous rather than benign samples. Learning a backdoored reference model is significantly easier than learning a reference model on benign data. Consequently, we can identify poisonous samples much more accurately than related work identifies benign samples. This crucial difference enables near-perfect backdoor removal as we demonstrate in our evaluation. HARVEY substantially outperforms related approaches across attack types, datasets, and architectures, lowering the attack success rate to the very minimum at a negligible loss in natural accuracy. The figure below shows an overview of our methods working principle.

The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

Tue, 07 Jul 2026 00:00:00 +0000

Paper Link: https://arxiv.org/abs/2607.05743

AI Summary (中文)

背景与问题

当前AI编程智能体（AI coding agents）已具备自主读取代码仓库、调用工具及执行Shell命令的能力，且人类监督日益减少。其执行层安全性正成为关键研究焦点，但相关工作高度碎片化：沙箱隔离、能力模型、访问控制、策略执行、TOCTOU竞态、MCP协议威胁、身份委派、执行溯源、网络出口管控及代理生成代码的静态分析等方向各自为政，引用稀疏、术语不一、评估标准缺失，形成典型的“巴尔干化”（Balkanization）现象。

方法与贡献

本研究系统梳理2023–2026年间发表的39篇核心论文，依据原始文献实证验证，归纳出17个互斥且可复现的分类维度；同步确认4个已披露并修复的CVE漏洞直接影响生产级智能体运行时（agent harnesses）。跨类别横向分析揭示五大共性研究缺口：
1. 隔离架构与能力模型缺乏统一基准对比；
2. 策略执行研究中高达69%–98%的拒绝列表失效率未被隔离机制反向验证；
3. TOCTOU与MCP威胁本质同属“状态校验失效”，却被割裂研究；
4. 所有强制机制均隐含“策略作者可信”假设，忽视策略编写错误本身的风险；
5. 17.1%的良性但越界操作（如非恶意却超权限的Git配置读取）未被任何访问控制或能力模型覆盖。

本文是首项专精于AI编码智能体执行安全的系统性综述，填补了现有AGI安全综述中执行层长期缺位的空白，并提出面向上述五类缺口的可操作研究议程。

AI Summary (English)

This paper systematizes execution-security research for AI coding agents—a fragmented landscape spanning sandboxing, capability models, access control, TOCTOU races, MCP threats, and policy enforcement. We analyze 39 papers (2023–2026), verifying and organizing them into 17 empirically grounded categories; our protocol also confirms 4 patched CVEs affecting production agent harnesses. Cross-category analysis reveals five critical, unaddressed gaps: (1) no shared benchmark compares isolation architectures or capability models; (2) policy-enforcement studies report 69–98% denylist failure rates, yet isolation papers never re-evaluate under such adversarial conditions; (3) TOCTOU and MCP are distinct literatures despite sharing the same state-validation root cause; (4) all enforcement mechanisms assume honest policy authors, ignoring policy-authoring errors; and (5) benign out-of-scope actions occur at up to 17.1% frequency under realistic prompts but are ignored by all access-control or capability work. This is the first dedicated systematization of execution security for agentic AI—complementing broader AGI security surveys that treat sandboxing as just one item among many. We conclude with a concrete research agenda targeting these five gaps.

Abstract

AI coding agents now read repositories, call tools, and execute shell commands with limited human oversight, and a fast-growing body of work studies whether the execution layer around them is actually safe. That literature is scattered. Papers on sandbox isolation, capability and access control, policy enforcement, time-of-check-to-time-of-use (TOCTOU) races, Model Context Protocol (MCP) threats, identity delegation, execution provenance, network egress control, and static analysis of agent-generated code are published independently and rarely cite one another. We systematize 39 papers published between 2023 and 2026 into 17 categories, each verified directly against its source. The same verification protocol also confirms four disclosed, patched CVEs directly affecting production agent harnesses. Reading across categories surfaces five cross-cutting gaps that no single paper addresses. (1) Isolation architectures and capability models are almost never evaluated against one another on a shared benchmark. (2) Policy-enforcement studies report failure rates from 69% to 98% of real denylists, yet no isolation paper re-evaluates its own defense under that adversarial setting. (3) TOCTOU and MCP threats are analyzed as separate literatures despite both being instances of the same state-validation problem. (4) Every enforcement mechanism assumes an honest policy author, leaving policy-authoring error itself unaddressed. (5) Benign but out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting are addressed by no access-control or capability paper in the corpus. Existing broader surveys of agentic AI security discuss sandboxing only as one item among many defenses, leaving execution security without a dedicated systematization. This paper is written to fill that gap. We conclude with a research agenda directed at the five gaps.