Searcharxiv⌕ Search

subject

cs.CR

cs.CR: explore 594 source-linked works published from 2022 to 2026, with original documents and citations.

This collection is a preview while coverage and quality are evaluated.

Search within this collection

Coverage and selection

Includes records with this source-supplied label or an explicit phrase match in their metadata. Matches indicate a mention, not proof that a paper uses a method or tests a material. Source versions are consolidated by DOI.

Sources: arxiv. Collection updated 2026-09-16. Counts describe this index, not the complete source archives.

arXiv2026

Degree bounds and synchronization in Gröbner basis computations for affine semi-regular systems

Determining the complexity of computing Gröbner bases is an important problem in both theory and practice, and solving degrees provide a central measure of this complexity. We study solving degrees and Gröbner basis computations for affine polynomial systems, with particular emphasis on semi-regular sequences. We first derive two upper bounds for the maximum Gröbner basis degree of the homogenized system. One is based on a regular initial subsequence of the highest-degree homogeneous parts. When these parts form a semi-regular sequence in nondecreasing degree order, the bound involves the $n$ smallest input degrees together with the largest one. The other bound is expressed in terms of the saturation exponent with respect to the homogenizing variable. Both are obtained by bounding the degree from which the Hilbert function of the quotient ring associated with the homogenized system is constant. We then compare the Buchberger-like Gröbner basis computations for an affine system, its homogenization, and its highest-degree homogeneous parts. The first degree fall is characterized by failure of injectivity of multiplication by the homogenizing variable. Before that point, choices of S-pairs and reducers in any computation can be matched in the others, and reduction sequences, remainders, intermediate bases, and leading monomials correspond under specialization. Cryptographic semi-regularity guarantees this correspondence until the step degree first reaches the degree of regularity. At that degree, affine reduction steps that preserve the sugar degree lift to homogeneous ones, yielding upper bounds on the algorithmic solving degree for a computation starting directly from the affine input.

math.AC↗
arXiv2026

GENIE: Watermarking Graph Neural Networks for Link Prediction

The rapid adoption, usefulness, and resource-intensive training of Graph Neural Network (GNN) models have made them an invaluable intellectual property in graph-based machine learning. However, their wide-spread adoption also makes them susceptible to stealing, necessitating robust Ownership Demonstration (OD) techniques. Watermarking is a promising OD framework for deep neural networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data. Existing works on GNN watermarking primarily focus on node and graph classification, overlooking Link Prediction (LP). In this paper, we propose GENIE (watermarking Graph nEural Networks for lInk prEdiction), the first scheme to watermark GNNs for LP. GENIE creates a novel backdoor for both node-representation and subgraph-based LP methods, utilizing a unique trigger set and a secret watermark vector. Our OD scheme is equipped with Dynamic Watermark Thresholding (DWT), ensuring high verification probability while addressing practical issues in existing OD schemes. We extensively evaluate GENIE across 4 diverse model architectures (i.e., SEAL, GCN, GraphSAGE and NeoGNN), 7 real-world datasets and 21 watermark removal techniques and demonstrate its robustness to watermark removal and ownership piracy attacks. Finally, we discuss adaptive attacks against GENIE and a defense strategy to counter it. The codebase and related artifacts are publicly available at our Project Page.

cs.CR↗
arXiv2026

Security Testing Framework for Web Applications: Benchmarking ZAP V2.12.0 and V2.13.0 by OWASP as an example

The Huge growth in the usage of web applications has raised concerns regarding their security vulnerabilities, which in turn pushes toward robust security testing tools. This study compares OWASP ZAP, the leading open-source web application vulnerability scanner, across its two most recent iterations. While comparing their performance to the OWASP Benchmark, the study evaluates their efficiency in spotting vulnerabilities in the purposefully vulnerable application, OWASP Benchmark project. The research methodology involves conducting systematic scans of OWASP Benchmark using both v2.12.0 and v2.13.0 of OWASP ZAP. The OWASP Benchmark provides a standardized framework to evaluate the scanner's abilities in identifying security flaws, Insecure Cookies, Path traversal, SQL injection, and more. Results obtained from this benchmark comparison offer valuable insights into the strengths and weaknesses of each version of the tool. This study aids in web application security testing by shedding light on how well-known scanners work at spotting vulnerabilities. The knowledge gained from this study can assist security professionals and developers in making informed decisions to support their web application security status. In conclusion, this study comprehensively analyzes ZAP's capabilities in detecting security flaws using OWASP Benchmark v1.2. The findings add to the continuing debates about online application security tools and establish the framework for future studies and developments in the research field of web application security testing.

cs.CR↗
arXiv2026

X-SG$^2$S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

3D Gaussian Splatting (3DGS) has been widely used in 3D reconstruction and 3D generation. However, the rapid adoption of 3D Gaussian Splatting raises growing concerns about information leakage and unauthorized use, urging the exploration of effective watermarking techniques. However, existing methods are limited by low capacity, fragility under geometric perturbations, and the infeasible requirement for costly fine-tuning or pipeline modifications, motivating the need for a generalizable, feed-forward framework capable of robust multi-modal embedding with minimal intrusion. In this paper, we propose a new framework X-SG$^2$S which can simultaneously inject 1D to 3D watermarks for copyright protection, while keeping the high fidelity of original 3DGS scenes. Specifically, we first split the watermarks into message patches. A self-adaptive gate is developed to select the injection positions of the watermark messages. Then, we use an XD (multi-dimensional) injection head to inject multi-modal messages into sorted 3DGS points. To restore watermarking messages, a learnable gate is developed to recognize the watermarked locations, from which our XD-extraction heads are used to restore hidden messages. X-SG$^2$S is the first framework to unify 1D-to-3D watermarking and enable simultaneous multi-modal watermark embedding in 3DGS, achieving this with minimal rendering interference and zero modifications to parameters or pipelines. Extensive experiments demonstrate that X-SG$^2$S effectively preserves consistency between the watermark and the original 3DGS, exhibits robustness against model degradation, and maintains accurate judgment capabilities.

cs.CR↗
arXiv2026

The Popularity Hypothesis in Software Security: A Large-Scale Replication with PHP Packages

There has been a long-standing hypothesis that a software's popularity is related to its security or insecurity in both research and popular discourse. There are also a few empirical studies that have examined the hypothesis, either explicitly or implicitly. The present work continues with and contributes to this research with a replication-motivated large-scale analysis of software written in the PHP programming language. Two datasets are used: the first contains nearly four hundred thousand open source software packages written in PHP and the second addresses over six thousand WordPress components. According to the results based on vulnerabilities reported, the hypothesis holds: packages having seen reported vulnerabilities over their release histories are generally more popular than packages for which fewer or no vulnerabilities have been reported. With this replication results, the paper contributes to the efforts to strengthen the empirical knowledge basis in cyber and software security. In addition, the paper makes a contribution to the recent discussion on the terminology about software vulnerabilities and the associated construct validity problems that follow.

cs.SE↗
arXiv2026

GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods

Despite the growing interest in jailbreaks as an effective red-teaming tool for building safe and responsible large language models (LLMs), flawed evaluation system designs have led to significant discrepancies in their effectiveness assessments. With a systematic measurement study based on 37 jailbreak studies since 2022, we find that existing evaluation systems lack case-specific criteria, resulting in misleading conclusions about their effectiveness and safety implications. In this paper, we introduce GuidedBench, a novel benchmark comprising a curated harmful question dataset and GuidedEval, an evaluation system integrated with detailed case-by-case evaluation guidelines. Experiments demonstrate that GuidedBench offers more accurate evaluations of jailbreak performance, enabling meaningful comparisons across methods. GuidedEval reduces inter-evaluator variance by at least 76.03%, ensuring reliable and reproducible evaluations. We reveal why existing jailbreak benchmarks fail to evaluate accurately and suggest better evaluation practices.

cs.CL↗
arXiv2026

On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification

What fundamentally distinguishes an adversarial attack from a misclassification due to limited model expressivity or finite data? In this work, we investigate this question in the setting of high-dimensional binary classification, where statistical effects due to limited data availability play a central role. We introduce a new error metric that precisely capture this distinction, quantifying model vulnerability to consistent adversarial attacks -- perturbations that preserve the ground-truth labels. Our main technical contribution is an exact and rigorous asymptotic characterization of these metrics in both well-specified models and latent space models, revealing different vulnerability patterns compared to standard robust error measures. The theoretical results demonstrate that as models become more overparameterized, their vulnerability to label-preserving perturbations grows, offering theoretical insight into the mechanisms underlying model sensitivity to adversarial attacks.

stat.ML↗
arXiv2026

Bayesian and Multi-Objective Decision Support for Incident Mitigation in Cyber-Physical Systems

Cyber-physical systems increasingly rely on interconnected physical and digital systems whose security incidents can escalate rapidly into safety and operational failures. Existing decision-support approaches struggle to support incident response because they rely on static assumptions, incomplete vulnerability data, and single-objective risk models that do not adequately capture trade-offs between attack success likelihood, impact severity, and system availability. This paper proposes an adaptive decision-support framework for incident mitigation in cyber-physical systems that integrates hierarchical Bayesian Network modelling, confidence-calibrated exposure estimation, and multi-objective optimisation into a unified, adaptive pipeline. The framework constructs probabilistic models from system architecture and vulnerability data, incorporating complementary vulnerability scores under epistemic uncertainty as conservative, uncertainty-aware reporting metrics for supporting downstream risk assessment. Mitigation strategies are explored as countermeasure portfolios and refined using multi-objective optimisation to identify Pareto-optimal trade-offs suitable for incident response scenarios. Frequency-based heuristics are applied to prioritise mitigation actions across optimisation runs. The framework is evaluated on three representative cyber-physical attack scenarios, demonstrating its ability to adapt to evolving threats and provide actionable decision support under operational constraints, with the aim of enhancing the resilience of cyber-physical systems.

cs.CR↗
arXiv2026

The Five Safes as a Privacy Context

The Five Safes is a framework used by national statistical offices (NSO) for assessing and managing the disclosure risk of data sharing. It can be understood as a specialization of a broader concept--contextual integrity--to the situation of statistical dissemination by an NSO. We demonstrate this by mapping the five parameters of contextual integrity onto the five dimensions of the Five Safes. We also discuss how each of these two theories can address weaknesses in the other, thereby strengthening them both.

cs.CR↗
arXiv2026

One Risk Down, Another Up: Cross-Risk Interactions Induced by LLM Defenses

Large Language Models (LLMs) are increasingly deployed in high-stakes settings, where they face diverse risks. Numerous defense strategies have been proposed to mitigate these risks, but they are almost always evaluated in isolation. This isolated view leaves a critical question open: does mitigating one risk inadvertently change a model's exposure to others? Beyond the well-studied risk-utility trade-off, we present the first systematic study of cross-risk interactions induced by LLM defenses. We propose CrossRiskEval, an evaluation paradigm that situates a defended model in a multi-dimensional risk space and quantifies how a defense built for one risk shifts the others. Among 166 cross-risk evaluations covering 32 defended models, 77.1% exhibit statistically significant cross-risk interactions. Most of these interactions amplify non-target risks, with increases exceeding 100% in some cases. Beyond behavioral evaluation, we conduct neuron-level analyses in seven selected cases to investigate one possible pathway associated with these interactions. We identify conflict-entangled neurons whose activation interventions produce opposing effects on proxies for the target and non-target risks. In conflict cases, restoring these neurons to their base-model activations partially reduces the corresponding risk increases, providing evidence that defense-induced changes to these neurons may contribute to the observed interactions. Building on this evidence, we propose Conflict-Aware Freezing, a training-time strategy that prevents direct updates to the parameters associated with the identified neurons. Across five conflict cases, it offsets 35%-196% of non-target risk amplification while meeting the original defense criterion.

cs.CR↗
arXiv2026

Quantum Private Distributed Matrix Multiplication: Extending the Classical Codes and Limitations

In this paper, we explore how quantum resources can be used to increase the rate of private distributed matrix multiplication (PDMM). In PDMM, a user who has two high-dimensional matrices, A and B, and lacks the computational capabilities to apply matrix multiplication locally, divides the matrices A and B into K and L sub-blocks, respectively. Then, the user sends them to N servers to apply the required multiplication \emph{privately}, i.e., any $T$ colluding servers cannot get any information about the user's matrices. The goal is to reduce the number of servers needed to perform the required matrix multiplication, thereby decreasing the communication cost. First, in the high-privacy regime, the state-of-the-art classical code is called the gap additive secure polynomial (GASP) code. We define a feasibility requirement in the quantum setting for the GASP code such that the highest performance is achieved when the requirement is satisfied. Thus, super-dense coding gain is achieved when the feasibility condition is satisfied. We show that when $T \geq KL-K+1$, the feasibility condition is always satisfied and the GASP code can be extended to the quantum version. In the case of $T < KL-K+1$, the feasibility can still be satisfied. To further examine this behavior, we numerically study how the minimum privacy requirement depends on the matrix dimensions and provide a quadratic estimate for this relation. The results suggest that feasibility can be achieved when $T \sim 0.5 KL$. Second, in the low-privacy regime, the recently developed cyclic-addition degree tables (CAT) and discretely optimized GASP (DOG) codes are among the most efficient known classical constructions for PDMM. We show that the feasibility condition developed for GASP can be adopted for both CAT and DOG codes as well, thus unifying the feasibility framework for multiple classical PDMM coding schemes.

cs.IT↗
arXiv2026

A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning

This paper presents a hybrid insider threat detection framework for enterprise environments, integrating multi-agent simulation, layered SIEM correlation, trust-adaptive thresholds, behavioral and communication forensics, and Theory-of-Mind reasoning. Email is treated not as a control channel but as a coordination and social-engineering evidence stream correlated with authentication, file-access, and privilege events. Four variants are evaluated: Layered SIEM-Core (LSC), Cognitive-Enriched SIEM (CE-SIEM), Evidence-Gated SIEM (EG-SIEM), and EG-SIEM-Enron with Enron-calibrated email forensics. Across ten matched runs with eight malicious insiders, actor-level F1 improves from 0.567 for LSC to 0.774 for CE-SIEM, 0.898 for EG-SIEM, and 0.944 for EG-SIEM-Enron; paired Wilcoxon tests confirm the first three differences after Holm-Bonferroni correction. Evidence gating reduces confirmed false positives from 33.7 per run under LSC and 49.3 under CE-SIEM to 0.2 and 0.0 respectively, a precision gain traded against longer confirmation time. Domain-shift evaluation shows that an Enron-trained email classifier does not transfer to a different operational email domain, although target-domain fine-tuning reaches F1 = 0.974 under grouped template-family evaluation. On CERT r4.2, the evidence-gated logic improves actor-level detection while reducing false positives, outperforming tabular anomaly detectors and a sentence-embedding baseline. Scalability tests to 1000 agents indicate stable detection quality.

cs.CR↗
arXiv2026

TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models

Large Reasoning Models (LRMs) introduce a reasoning-level attack surface: adversaries can corrupt intermediate inferences while preserving a plausible trace and an apparently benign output. Existing output guardrails cannot reliably identify where such a trace first becomes unsupported. We present TraceGuard, a compact, locally deployable reasoning firewall that treats model-generated reasoning as untrusted input. Its design combines grounded generation of verifiable audit traces, Step-Aware Supervised Fine-Tuning (SSFT) for process-level supervision, and Verifier-Guided Reinforcement Learning (VGRL) for hardening against difficult reasoning traces. TraceGuard audits intermediate steps, localizes the initial Point of Fracture, and grounds its final decision in the complete audit evidence. We evaluate TraceGuard across heterogeneous open-weight architectures, reasoning domains, and reasoning-integrity attack families. A compact Qwen3-4B-Guard substantially outperforms an unaligned 20B model under strict end-to-end detection. Its auditing behavior transfers to attack families excluded from training, resists in-scope black-box probing, and remains robust in an additional white-box stress test. Overall, 210,456 step-level audit decisions support compact, process-aligned verification as an effective, deployable defense boundary for reasoning systems.

cs.CR↗
arXiv2026

Combating Organized Platform Abuse: Amplifying Weak Risk Signals with Structural Information

Large-scale online service platforms face severe challenges from organized platform abuse: multiple forms such as credit card fraud and promotion abuse continually emerge, characterized by large numbers of involved accounts, rapid outbreaks, and constantly shifting tactics. Existing mainstream approaches, whether heuristic rules limited in precision, supervised learning with insufficient generalization, or graph models that are engineering-heavy and dependent on seed users, have failed to address such threats effectively. This paper returns to first principles and, starting from the economic constraints of fraudulent behavior, proposes the Fraudster's Trilemma: organized attackers cannot simultaneously achieve scale, low cost, and dispersed cash-out. Building on this theory, we derive a robust structural invariant in organized fraud, namely centralized cash-out, and use a simple statistical method to turn low-precision individual weak signals into high-precision strong decisions. The method requires no labels, is nearly parameter-free, white-box interpretable, has linear complexity O(|E|), avoids cold-start issues, and its detection logic possesses the "open-hand" property: attackers cannot evade it even when fully informed. We validate the approach on two real fraud incidents in backtests. In the promotion abuse case, a single near-zero-cost weak signal (global Precision of only 16%) after structural amplification achieves Precision above 91% and Recall exceeding 99% (z=10.0); at a higher threshold (z=40.0), Precision reaches 93.7%. In the credit card fraud case, an infrastructure-layer weak signal (device spoofing) successfully detects payment-layer attacks without any business-logic linkage, revealing the framework's natural MO-agnostic property: it relies more on the structural invariant than on signal semantics.

cs.CR↗
arXiv2026

Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning

Speech Emotion Recognition (SER) systems increasingly leverage self-supervised acoustic representations, yet their vulnerability to training-time attacks remains largely underexplored. This paper presents the first systematic study of poisoning-based backdoor attacks on SER, with a focus on threats enabled by text-to-speech (TTS) generated audio. We introduce a stealthy, low-energy acoustic trigger that can be embedded imperceptibly into both natural and synthetic speech, enabling scalable and consistent poisoning. Our experiments demonstrate that SER models can be reliably compromised with high attack success rates under low poisoning ratios, while maintaining near-clean performance on benign inputs. We further show that backdoor patterns exhibit strong cross-model transferability and that self-supervised representations are particularly susceptible to learning these triggers. These findings reveal that TTS technology dramatically lowers the barrier to effective backdoor attacks, exposing critical vulnerabilities in modern SER pipelines and motivating the urgent need for dedicated defenses.

cs.SD↗
arXiv2026

Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning

LLM-based vulnerability detectors have shown promising results in identifying memory-safety bugs and vulnerability classes whose violations can often be expressed through established security properties. Logic vulnerabilities, however, pose a different challenge, as their identification requires inferring application-specific security invariants and implicit assumptions about intended behavior. Even frontier agentic models struggle because these invariants are often implicit and buried among unrelated code. Motivated by this gap, we present Antaeus, a framework for detecting logic vulnerabilities that grounds LLM reasoning in repository-level code context. Antaeus follows a repository-scale pipeline combining function prioritization, context-grounded reasoning, comparative validation, and structured reporting. It ranks functions using lightweight repo-wide security signals, directing costly LLM analysis toward relevant code and reducing calls, cost, and triage effort. For each prioritized function, Antaeus combines local code context with a repository-level view of the application's functionality, security resources, and trust boundaries. This enables reasoning about how the function is executed within the broader application rather than as an isolated snippet. Antaeus identifies security-sensitive sinks, derives safety conditions for safe execution, and checks whether they are locally satisfied. Candidate findings undergo comparative validation, pruning concerns that reflect project-wide norms rather than distinctive violations. Finally, Antaeus reports sinks, violated safety conditions, and evidence, making findings actionable and traceable. We evaluate Antaeus on 35 repositories with confirmed logic vulnerabilities and compare it against function-level and agentic models. Antaeus detects and explains 20 vulnerabilities, outperforming baselines with comparable token usage and cost.

cs.CR↗
arXiv2026

CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary

Zero Trust (ZT) replaces implicit trust with continuous verification, but automated containment can destroy volatile evidence before preservation. We propose CUSTOS, a forensic-ready ZT reference architecture whose Forensic Management Point (FMP) links identity and policy context to tiered, rate-limited capture and orders volatile-state acquisition ahead of defender-routed destructive containment. In a controlled real-container experiment, the planted artifact was lost in all 1000 trials when capture and SIGKILL began concurrently, showing that the direct kill outran the evaluated acquisition path. The sequencing barrier completed capture before releasing that same kill in all 1000 trials. In a matched four-condition comparison, only sequencing recovered the transient artifact (200/200); a periodic snapshot-chain baseline recovered long-lived evidence (200/200) but missed the transient artifact at both cadences. Sequencing added 0.140 s of containment delay and 9.99 MB per event. At a 2 s cadence, the chain added no containment delay but suspended the workload for 4.9% of wall-clock and accrued 59.2 KB/s after its root snapshot. The always-on decision record reduced in-process request-path throughput by 1.9-3.0%. In-kernel enforcement and adversarial self-destruction bypass the sequencing barrier; CUSTOS preserves volatile state otherwise lost to defender-routed containment at measured cost.

cs.CR↗
arXiv2026

CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild

As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention, with closed-source LLMs (e.g., Mythos) delivering advanced cybersecurity capabilities. However, existing open-source efforts remain limited: frontier open-weight models do not provide reproducible cybersecurity training solutions, open-source training solutions focus on isolated tasks and lack scalable agentic data, and scaling agentic rollouts requires strong domain priors. In this work, we introduce \textbf{CyberFactory}, a unified open-source framework that connects data construction, trajectory synthesis, and model training across proof-of-concept (PoC) generation, vulnerability patching, and cybersecurity question answering (CyberQA). CyberFactory transforms public vulnerability artifacts, including CVEs from the wild, into executable and verifiable task instances. It further uses a reusable vulnerability-analysis skill to guide the teacher through source inspection, problem solving with domain prior, and evidence-based validation. The resulting supervision is agentic: the model interacts with tools and target environments and revises its solutions according to execution feedback. Using these trajectories, we train and release \modelname\footnote{\emph{Aegis} is, in Greek mythology, the protective shield of Zeus and Athena; the name reflects the model's defensive, security-oriented purpose.}, which internalizes the skill-guided procedure without requiring the skill at inference time. On CyberGym, \modelname reaches 52.4% Pass@1 under a one-hour budget, improving over its Qwen~3.5 base model by +22.8 points and outperforming the evaluated general-purpose backbones under the same scaffold.

cs.CR↗
Compare source metadata on this page
WorkPublishedSource identifierSource
Degree bounds and synchronization in Gröbner basis computations for affine semi-regular systems2026-09-012404.03530arxiv
GENIE: Watermarking Graph Neural Networks for Link Prediction2026-09-012406.04805arxiv
Security Testing Framework for Web Applications: Benchmarking ZAP V2.12.0 and V2.13.0 by OWASP as an example2026-09-012501.05907arxiv
X-SG$^2$S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks2026-09-012502.10475arxiv
The Popularity Hypothesis in Software Security: A Large-Scale Replication with PHP Packages2026-09-012502.16670arxiv
GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods2026-09-012502.16903arxiv
On the Existence of Consistent Adversarial Attacks in High-Dimensional Linear Classification2026-09-012506.12454arxiv
Bayesian and Multi-Objective Decision Support for Incident Mitigation in Cyber-Physical Systems2026-09-222509.00770arxiv
The Five Safes as a Privacy Context2026-09-012510.05803arxiv
One Risk Down, Another Up: Cross-Risk Interactions Induced by LLM Defenses2026-09-012510.07968arxiv
Quantum Private Distributed Matrix Multiplication: Extending the Classical Codes and Limitations2026-09-012511.23406arxiv
A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning2026-09-012601.04243arxiv
TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models2026-09-012603.02436arxiv
Combating Organized Platform Abuse: Amplifying Weak Risk Signals with Structural Information2026-09-012605.07383arxiv
Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning2026-09-012606.21052arxiv
Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning2026-09-012607.01138arxiv
CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary2026-09-012608.17068arxiv
CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild2026-09-012608.23181arxiv

These are bibliographic comparisons, not experimental rankings. Follow the original document for methods and conditions.