subject

cs.CR

cs.CR: explore 594 source-linked works published from 2022 to 2026, with original documents and citations.

This collection is a preview while coverage and quality are evaluated.

Coverage and selection

Includes records with this source-supplied label or an explicit phrase match in their metadata. Matches indicate a mention, not proof that a paper uses a method or tests a material. Source versions are consolidated by DOI.

Sources: arxiv. Collection updated 2026-09-16. Counts describe this index, not the complete source archives.

arXiv2026

Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain

AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: software bills of materials, signed releases, build provenance attestations, and declared official channels. Whether coding assistants read or act on those signals has not been measured for any of these classes on research software. We pre-registered and ran a controlled study on six open-source research software projects (three HPC, three quantum computing) drawn from an 87-project corpus, with protocol, seed, panel, and analysis plan deposited with a DOI before any trial. W created nine modified copies for each project: no signal, one per signal class, two with a signature or attestation from the wrong issuer, one with all four signals, and one reproducing documented conflicts in the project's own metadata. Three models under two ways of operating an assistant, with and without an approval step, gave 1,920 registered trials, plus a supplement on three frontier models. We scored behavior from container logs rather than from what the assistant said, and recorded the cost of every trial. Verification was rare under every condition: in 9 of 1,920 registered trials (0.5%), the assistant opened any provenance signal before installing in 0 of 384 control trials, and no trial ran a verification command, so signal presence had no measurable effect. We drew three conclusions: publishing signals is necessary but not sufficient; price did not buy verification (the model that verified most often costs $0.10 per trial; the most capable, at $1.00, verified nothing); verification must be built into the program that runs the assistant. We release the per-trial cost ledger, the protocol, and every log.

cs.CR↗

arXiv2026

A Note on Binary Quadratic Systems and their relation to complexity theory

Deciding whether a system of multivariate quadratic equations over $\mathbb F_2$ has a solution is a classical NP-complete problem, and remains so for square systems, with as many equations as variables. The hardness of this problem is one of the cornerstones of nowadays post-quantum cryptography. Let $\MQ_0(n)$ and $\MQ_1(n)$ denote the sets of square quadratic systems in $n$ variables having respectively no solutions and exactly one solution. $\cup_{n\geq 2} \MQ_0(n)$ is a coNP-complete language, while $\cup_{n\geq 2} \MQ_1(n)$ lies in DP. It is known that $\lim_{n\to \infty} |\MQ_1(n)|/|\MQ_0(n)|=1$. Here we prove the explicit finite-$n$ bounds \[ |\MQ_0(n)|<|\MQ_1(n)| \le \left(1+\frac{1}{2^n-1}\right)|\MQ_0(n)|, \] More generally, let $Q_d$ be the space of polynomial functions $(\FF_2)^n\to\mathbb F_2$ of degree at most $d$, and let $α_k$ count square systems in $(Q_d)^n$ having exactly $k$ solutions. Then \[ α_0<α_1 \le \left(1+\frac{1}{2^n-1}\right)α_0\,, \qquad 2\le d\le n \,. \] The proof combines matroid and coding-theoretic methods. We interpret $(\FF_2)^n$ as the ground set of the evaluation matroid of $Q_d$, express $α_0$ and $α_1$ through characteristic polynomials, and use a Whitney-type sign-reversing involution to show that the only terms that can push $α_1-α_0$ below $α_1/2^n$ come from the elements of a matroid port. These are identified with minimal-support words of the Reed--Muller code $\RM(n-d-1,n)=\RM(d,n)^\perp$; the required estimate then follows from the MacWilliams identity, the minimum-distance bound $2^{d+1}$, and the even-weight structure of the code.

cs.IT↗

arXiv2026

Nothing Breaks: No Single Peer Can Soundly Gate Post-Quantum Delivery

Post-quantum protection is delivered to a peer, not declared in a file: whether a session is quantum-resistant is a relation between a server's configuration and the clients that reach it. We show that no single peer can soundly gate that relation. Shipped SSH clients are not ordered: two of their post-quantum capability classes are minimal and incomparable, so a check pinned to either misses the other family's withdrawal. A peer taking both fares no better: it falls back and misses both, or, where classical outranks one family, catches just that one. No case flags both. Nothing above the wire carries the relation either. An artifact-side instrument cannot encode it, because a peer population is not one of its inputs; and across seven configurations on two protocols we find that not one of the five scalars deployed auditors expose to automation moves, while unrelated degradation moves the ones that discriminate at all: the auditors do compute the delivered algorithm, and discard it at the interface automation reads. Nothing else catches the loss either, because nothing breaks: removing a hybrid key exchange starts the daemon, validates the configuration, passes the tests and serves the client, and the adversary it defends against does not exist yet, so no functional signal can carry the loss even in principle. We then show that agents make that state reachable at scale, driving a validated downgrade in 40 of 40 episodes from ordinary engineering prose, against 0 of 40 on a matched neutral document.

cs.CR↗

arXiv2026

EventSpec: Defining and Detecting Event-Semantic Issues in Blockchain Ecosystems

In recent years, smart contracts have become the backbone of decentralized applications (DApps), and off-chain systems such as bridges, wallets, and indexers rely heavily on event logs to track contract execution and state changes. However, the Ethereum Virtual Machine (EVM) does not validate or enforce event semantics, so logs can diverge from on-chain state, misleading off-chain systems into accepting incorrect state transitions. Existing smart contract vulnerability detection tools focus on logic bugs, with limited support for detecting event-semantic defects. To address this gap, we collect audit reports and incident cases and apply open card sorting to define five classes of event-semantic defects: event collision, state-event mismatch, unauthorized event emission, event emission mismatch, and event parameter mismatch. We propose EventSpec, which infers event specifications from a contract corpus via behavior inference and semantic-constraint extraction and applies differential checking to identify event-semantic defects in target contracts. We run EventSpec on 6,617 real-world contracts and evaluate detection effectiveness based on manually labeled results; EventSpec achieves an overall comprehensive precision of 90.17%. We further provide an off-chain evaluation harness that reproduces two off-chain attack vectors on any EVM-compatible chain: event origin confusion caused by unintended emitters and event-state desynchronization where events lack matching state updates. Using this harness, we demonstrate the feasibility of these attacks on bridge relayers, blockchain explorers, and NFT marketplaces, and report six wallet issues, four of which were confirmed (including a $600 bounty), with two remaining pending.

cs.CR↗

arXiv2026

A Novel Steganography Scheme Using Quantum Hilbert Transform

The main goal of steganography is to transmit hidden messages in legitimate-looking communication messages. Phase-domain information hiding, however, has not been fully explored for quantum systems. This work introduces a finite-dimensional Quantum Hilbert Transform (QHT) as a unitary phase operator based on the Quantum Fourier Transform. Using this construction, we develop a QHT-based quantum steganography scheme that embeds classical bits as weak signed phase perturbations of quantum cover states. Bob recovers the hidden message through binary state discrimination, block aggregation, and classical error-correcting decoding.

quant-ph↗

arXiv2026

Guppy: Efficient Light Clients via Recursive Zero-Knowledge Proofs

Traditional light clients rely on validators committing to the entire blockchain state at every block via a state commitment such as a Merkle tree, allowing clients to verify facts using short proofs. However, maintaining large and ever-growing state trees imposes a significant burden on validators and lies on the critical path of block production. As a result, many modern high-throughput chains avoid this approach altogether. This work asks whether efficient inclusion proofs can be supported without requiring validators to maintain full state commitments. We present Guppy, a protocol that achieves this by having validators commit to just the state updates. An off-chain, untrusted service, secured by recursive Zero-Knowledge Proofs (ZKPs), then maintains a verifiable Merkle tree over the full state. This design keeps validator overhead negligible and does not increase the asymptotic complexity of block construction. Our design rests on two key technical ideas. First, a hash-chain commitment moves validator signature verification out of the ZK circuit, keeping the proving circuit efficient. Second, we design a parallel recursive proving pipeline that leverages cheap recursion in modern ZKPs to ensure latency grows only logarithmically with throughput. Our Plonky2-based implementation demonstrates that Guppy can maintain a Merkle tree of size 2^30 while processing thousands of updates per second, adding only 2-4 s of latency.

cs.CR↗

arXiv2026

"Shut Up and Let Me Enjoy My Otome": Understanding and Measuring the Toxicity in Otome Game Communities

Otome games, a romance simulation genre primarily targeting female, have emerged as a major force in the global gaming market, attracting hundreds of millions of players and billions in revenue. Despite their popularity, otome game communities face pervasive online toxicity, which has been largely unexplored. In this work, we present the first large-scale measurement of toxicity in otome game communities across social platforms. We introduce OtomeSCAN, a framework for collecting, evaluating, and analyzing 620,045 posts from Weibo and Reddit spanning 18 months. To support robust analysis, we manually annotated a ground-truth dataset of 4,308 posts, identifying eight target groups such as players and game developers. We evaluate seven toxicity detectors on the dataset, including general-purpose models and our proposed LLM-based detectors, with our best model achieving F1-scores of 0.82 (Weibo) and 0.78 (Reddit). Our analysis reveals significant platform-based differences in toxicity: 22.20% of otome-related posts on Weibo are toxic, compared to 3.71% on Reddit. Besides, real-world events like in-community conflicts can rapidly escalate toxicity, with toxicity ratios increasing to 37.09% in just 72 hours during an external attack on Weibo. We also flag 191 potential-coordination clusters in otome game communities, 64.40% of which target game developers, with several accounts participating repeatedly across multiple clusters. We hope our work inspires further research on community-specific toxicity and contributes to building healthier online spaces for marginalized gaming communities.

cs.CR↗

arXiv2026

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependency is actually exploitable. Security analysts typically spend substantial time assessing vulnerability exploitability case by case. Recent LLM agents have emerged as promising candidates for this task given their advanced capabilities in coding and cybersecurity, yet no existing benchmark evaluates them on it. Prior benchmarks target zero-day settings, where agents detect and exploit previously unknown vulnerabilities. In contrast, software supply chain security focuses on how known vulnerabilities in upstream dependencies affect downstream projects. This requires agents to reason across repositories and determine whether an upstream vulnerability is exploitable in the downstream project. To address this gap, we introduce VEX-Bench, the first benchmark for evaluating LLM agents' ability to assess the exploitability of software supply chain vulnerabilities. It contains 75 real-world cases mined from GitHub and labeled by security experts, covering Python, Java, and Go. We evaluate nine models across three agent harnesses. While GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. This gap highlights the challenge of moving beyond binary exploitability assessment to identifying fine-grained exploitability reasons. Code and data: https://github.com/steven1518/vex-bench

cs.CR↗

arXiv2026

Compute-Bounded Security Assurance - Coverage, Verification, and Response under Resource Constraints

Additional inference compute can increase the number of correctly resolved security-assurance tasks, but repeated success, unique coverage, accepted evidence, and operational protection are different quantities. We develop a resource-constrained framework that separates them. For repeated conditionally independent attempts with latent success probability $Θ$, coverage is $C_n = 1 - E[(1-Θ)^n]$, and its limiting value is $1 - P(Θ= 0)$. Positive pairwise outcome correlation does not by itself imply a ceiling below one: we construct two models with the same mean success and pairwise correlation but different limiting coverage. We distinguish this result from the effective sample size used to estimate a mean, and show why finite-budget observations cannot generally identify an asymptotic support ceiling. We then connect coverage to fallible evidence checking, proper scoring of factual grounding, complete resource accounting, service capacity, and a response model that includes mitigation delay. A conceptual defensive architecture separates evidence analysis, adjudication, and operational authority. An evaluation protocol specifies held-out tasks, paired comparisons, negative cases, and uncertainty reporting. The contribution is a consistent theoretical synthesis and a set of counterexamples to invalid extrapolations, rather than an empirical scaling law. All numerical illustrations are analytic; no model-parity result, hardware benchmark, or general attacker-defender equilibrium is claimed.

cs.CR↗

arXiv2026

D-ADD: An Effective Plug-In for Defending Against Model Stealing

Malicious users attempt to replicate commercial models functionally at low cost by training a clone model with query responses. Timely prevention of such model-stealing attacks is challenging, as it requires achieving robust protection, maintaining utility, and ensuring low deployment overhead at the same time. In this paper, we propose a novel non-parametric detector called Account-aware Distribution Discrepancy (ADD) to recognize queries from malicious users by leveraging account-wise local query dependency. We formulate each class as a Multivariate Normal distribution (MVN) in the feature space and measure the malicious score as the sum of weighted class-wise distribution discrepancy. Together with shift adjustment, the ADD$^+$ detector is enhanced with the capability to manage domain shifts. When integrated with random-based prediction poisoning, it serves as a practical plug-and-play defense module, termed D-ADD, for image classification models. Results of extensive experimental studies show that D-ADD achieves strong defense against different types of attacks with little interference in serving benign users for both soft and hard-label settings. Codes are available from https://github.com/AI-EXP-group/D-ADD.

cs.CR↗

arXiv2026

Why Does Weak-OOD Help? A Further Step Towards Understanding Jailbreaking VLMs

Large Vision-Language Models (VLMs) are susceptible to jailbreak attacks: researchers have developed various attack strategies that bypass the safety mechanisms of VLMs. Among these approaches, jailbreak methods based on the Out-of-Distribution (OOD) strategy have garnered widespread attention due to their simplicity and effectiveness. This paper further advances the understanding of OOD-based VLM jailbreak methods. We show that mild OOD manipulations can achieve stronger jailbreak performance than both clean inputs and overly strong perturbations, a non-monotonic pattern we define as "weak-OOD". We explain this phenomenon through a trade-off between two dominant factors: input intent perception and model refusal triggering. Our evidence suggests that these two factors respond differently to OOD manipulations, which is consistent with a discrepancy between broad pre-training robustness and narrower safety alignment. Building on this insight, we draw inspiration from optical character recognition (OCR) capability enhancement---a core task in the pre-training phase of mainstream VLMs. Leveraging this capability, we design JOCR (Jailbreak via OCR-Aware Embedded Text Perturbation), a practical OCR-readable extension of embedded-text jailbreaks that achieves the best average ASR among evaluated baselines. Code is available at GitHub: https://github.com/Yuxuan2003/weak-ood-jailbreak.

cs.CR↗

arXiv2026

Certified-Everlasting Quantum NIZK Proofs

We study non-interactive zero-knowledge proofs (NIZKs) for NP satisfying: 1) statistical soundness, 2) computational zero-knowledge (ZK) and 3) certified-everlasting zero-knowledge (CE-ZK). The CE-ZK property allows a verifier of a quantum proof to revoke the proof in a way that can be checked (certified) by the prover. Conditioned on successful certification, the verifier's state can be efficiently simulated with only the statement, in a statistically indistinguishable way. Our contributions regarding these certified-everlasting NIZKs (CE-NIZKs) are as follows: - We identify a barrier to obtaining CE-NIZKs in the CRS model via generalizations of known interactive ZK proofs that satisfy CE-ZK. - We circumvent this by constructing CE-NIZK using non-black-box use of NIZK for NP satisfying certain properties, along with OWFs. As a result, we obtain CE-NIZKs for NP in the CRS model, based on polynomial hardness of the learning with errors (LWE) assumption. - In addition, we observe that the aforementioned barrier does not apply to the shared EPR model. We leverage this to construct CE-NIZK for NP in this model based on any statistical binding hidden bits generator, which is known from LWE. The only quantum computation here involves single-qubit measurements of the EPR pairs.

quant-ph↗

arXiv2026

Differentiation Between Faults and Cyberattacks through Combined Analysis of Cyberspace Logs and Physical Measurements

In recent years, cyberattacks - along with physical faults - have become an increasing factor causing system failures, especially in DER (Distributed Energy Resources) systems. In addition, according to the literature, a number of faults have been reported to remain undetected. Consequently, unlike anomaly detection works that only identify abnormalities, differentiating undetected faults and cyberattacks is a challenging task. Although several works have studied this problem, they crucially fall short of achieving an accurate distinction due to the reliance on physical laws or physical measurements. To resolve this issue, the industry typically conducts an integrated analysis with physical measurements and cyberspace information. Nevertheless, this industry approach consumes a significant amount of time due to the manual efforts required in the analysis. In this work, we focus on addressing these crucial gaps by proposing a non-trivial approach of distinguishing undetected faults and cyberattacks in DER systems. Specifically, first, a special kind of dependency graph is constructed using a novel virtual physical variable-oriented taint analysis (PVOTA) algorithm. Then, the graph is simplified using an innovative node pruning technique, which is based on a set of context-dependent operations. Next, a set of patterns capturing domain-specific knowledge is derived to bridge the semantic gaps between the cyber and physical sides. Finally, these patterns are matched to the relevant events that occurred during failure incidents, and possible root causes are concluded based on the pattern matching results. In the end, the efficacy of the proposed semi-automatic integrated analysis is evaluated through five case studies covering failure incidents caused by FDI attacks, system faults, and memory corruption attacks, including a false-classification scenario.

cs.CR↗

arXiv2026

Partial Number Theoretic Transform Masking in Post-Quantum Cryptography (PQC) Hardware: A Security Margin Analysis

Adams Bridge, a hardware accelerator for ML-DSA and ML-KEM designed for the Caliptra root of trust, masks 1 of its Inverse Number Theoretic Transform (INTT) layers and relies on shuffling for the remainder, claiming per-butterfly Correlation Power Analysis (CPA) complexities of 2^46 (ML-DSA) and 2^96 (ML-KEM). We evaluate these claims across seven tracks with confidence-rated evidence. Register-Transfer Level (RTL) analysis confirms the design's Random Start Index (RSI) shuffling provides 6 bits of entropy per layer (64 orderings), not the 296 bits of a full random permutation. Under corrected test stimulus, the masked INTT round's butterfly register group fails first-order Test Vector Leakage Assessment (TVLA) at the RTL level, inverting the earlier verdict; the security margins are not re-derived from that result. A soft-analytical attack pipeline demonstrates a 37-bit attack-model gap, not a reduction in total work: it follows from the RSI structure alone, is independent of BP gains and measured SNR, and achieves no key recovery. Full-scale BP on the complete ML-KEM INTT factor graph achieves 100% coefficient recovery at SNRxN = 3,000; that graph decomposes into two independent 128-coefficient components. Layer-ablation over all 35 four-layer subsets shows observation topology sets the trace budget for BP convergence, not necessary conditions: input-adjacency and gap raise that budget by up to roughly 10x and by roughly 4x; output-anchoring and layer count are not priced. Four spread layers recover the full key in 78 of 80 seeds at SNRxN = 5,000; four consecutive need ~100x that. Masking 3 consecutive mid-layers (43% overhead) defers full recovery to SNRxN = 20,000 rather than preventing it; partial masking bounds attacker cost. We contribute an audit methodology assembled from established practice into a reproducible critique of partially masked NTT accelerators.

cs.CR↗

arXiv2026

Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networks

Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a clean model. These guarantees, however, have been confined to stylised architectures of limited practical relevance, leaving open whether comparable undetectability extends to modern, end-to-end trained networks. We construct such an attack mechanism for state-of-the-art architectures, closely aligned to the cryptographic notion of undetectability, by identifying backdoor channels as learned latent directions, and show that the question of undetectability reduces to a hypothesis test between two unknown distributions over model parameters, which we conjecture to be intractable in practice. The consequence of this reframing is significant: if exploitable channels within a network's latent space are statistically indistinguishable from naturally learned directions, an attacker need not introduce foreign structure but can instead exploit the geometry the network already possesses. Demonstrating the approach on ResNet and Vision Transformer architectures trained on standard image classification datasets, the attack achieves both consistently high success rates with negligible clean accuracy degradation, and resists a comprehensive suite of post-training defences, none of which neutralise the backdoor without rendering the model unusable. Our results establish that cryptographic backdoors need not be artefacts requiring exotic architectures or artificial constructions, but identifiable as latent properties inherent to the geometry of learned representations.

cs.CR↗

arXiv2026

Entropy Bootstrapping for Wireless Embedded Systems

Cryptographic protocols require unpredictable randomness at first boot, yet wireless sensors often wake with uninitialized hardware or noise sources running in unverified operating states. In platforms like the ESP32, statistical testing cannot catch this cold-start failure because the internal random number generator continues returning statistically plausible bytes even when analog radio noise is disabled, producing pure pseudorandomness by design. To prevent nodes from silently anchoring security in a single unverified source, we introduce a defense-in-depth boot architecture governed by explicit source-state admission. The system combines three orthogonal roots of unpredictability: startup noise from uninitialized SRAM cells, local wireless RNG output gathered during a bounded window defined by an external packet burst, and a signed post-quantum asymmetric capsule delivering fresh entropy from a trusted peer without requiring local random generation. Rather than blending unverified numbers, the admission policy gates entropy credit on the verified operating mode of the hardware, admitting wireless RNG output only while the radio frequency circuits are active. Empirical trials confirm that incoming network traffic successfully bounds repeatable, uncorrelated hardware sampling windows, while remote capsule verification completes with minimal processing overhead. By coupling physical operating state to cryptographic accounting, commodity microcontrollers can bootstrap reliable seed entropy across complementary roots without relying on additional dedicated security hardware.

cs.CR↗

arXiv2026

Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization

Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.

cs.CR↗

arXiv2026

RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution

LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability. We propose RedEvoAgent, a black-box red-teaming agent that distills cross-case attack trajectories into a concise, human-readable attack skill. The attack skill adaptively evolves through tool-effectiveness profiling and Deciding-Tool Attribution for skill updates, and a validation ratchet that retains only updates improving validation performance. Experiments on multiple benchmarks, target models, and target execution harnesses show that RedEvoAgent outperforms fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution harnesses.

cs.CR↗

Compare source metadata on this page

Work	Published	Source identifier	Source
Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain	2026-09-07	2609.07754	arxiv
A Note on Binary Quadratic Systems and their relation to complexity theory	2026-09-07	2609.07769	arxiv
Nothing Breaks: No Single Peer Can Soundly Gate Post-Quantum Delivery	2026-09-07	2609.07849	arxiv
EventSpec: Defining and Detecting Event-Semantic Issues in Blockchain Ecosystems	2026-09-07	2609.07865	arxiv
A Novel Steganography Scheme Using Quantum Hilbert Transform	2026-09-07	2609.07894	arxiv
Guppy: Efficient Light Clients via Recursive Zero-Knowledge Proofs	2026-09-23	2609.07963	arxiv
"Shut Up and Let Me Enjoy My Otome": Understanding and Measuring the Toxicity in Otome Game Communities	2026-09-07	2609.08009	arxiv
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities	2026-09-07	2609.08040	arxiv
Compute-Bounded Security Assurance - Coverage, Verification, and Response under Resource Constraints	2026-09-07	2609.09229	arxiv
D-ADD: An Effective Plug-In for Defending Against Model Stealing	2026-09-06	2503.12497	arxiv
Why Does Weak-OOD Help? A Further Step Towards Understanding Jailbreaking VLMs	2026-09-06	2511.08367	arxiv
Certified-Everlasting Quantum NIZK Proofs	2026-09-06	2512.13628	arxiv
Differentiation Between Faults and Cyberattacks through Combined Analysis of Cyberspace Logs and Physical Measurements	2026-09-06	2601.03289	arxiv
Partial Number Theoretic Transform Masking in Post-Quantum Cryptography (PQC) Hardware: A Security Margin Analysis	2026-09-06	2604.03813	arxiv
Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networks	2026-09-06	2605.13214	arxiv
Entropy Bootstrapping for Wireless Embedded Systems	2026-09-06	2607.08865	arxiv
Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization	2026-09-06	2608.16403	arxiv
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution	2026-09-06	2608.27439	arxiv

These are bibliographic comparisons, not experimental rankings. Follow the original document for methods and conditions.