arXiv cs.CRDependability and SecurityarXivapproachempirical studysurveyConfidentialityintegrityprivacycs.CRarXiv cs.CR
Accountable partial understanding: securing the epistemic attack surface of agentic systems
Josiah Dykstra
2026/10/20 01:44已过 2 天
Attackers profit from what defenders do not understand. Software security has treated the gap between system behavior and human comprehension as a condition to narrow through analysis and assurance, booking the remainder as accepted risk. Agentic AI systems change that gap: when software reads, writes, explains, and authorizes security-relevant behavior, partial understanding moves faster, grows more opaque, and couples to delegated authority. This paper characterizes the resulting epistemic attack surface and presents a taxonomy of four interacting attack categories, which target the interpretation of intent, the production and consumption of evidence, the scope of delegated authority, and the comprehension of human supervisors. It then defines accountable partial understanding (APU) and specifies six necessary conditions: bounded scope with explicit assumptions, inspectable evidence, assigned responsibility, visible residual unknowns, actionability, and temporal maintenance. It explains why delegating interpretation to software agents differs from distributing knowledge among people and distinguishes APU from risk acceptance, explainable AI, assurance cases, formal verification, and human-in-the-loop oversight. From the conditions, the paper derives five design principles: bounded delegation, decoupled evidence, assumption tracking with invalidation, role-specific accountability views, and intervention-preserving design with residual unknown registers. It introduces two measurable probe dimensions, evidence linkage and invalidation latency, for testing whether accountability mechanisms hold under change and adversarial pressure. Three running examples (an AI coding agent, an autonomous cyber-defense agent, and an AI-mediated insulin delivery update) ground the analysis. Security without full understanding is already here; the task is to make it accountable.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CRcs.AIcs.CLcs.GT
Game of Phones: Harnessing Game Theory and LLMs in 'Bot Wars' to Counteract Phone Scams
Nardine Basta, Robin Carpentier, Benjamin Zi Hao Zhao, Dali Kaafar
2026/10/20 01:35已过 2 天
Phone scams impose substantial and growing costs on individuals and financial systems worldwide, yet existing countermeasures impose no resource cost on perpetrators. Strategic scam-baiting, in which automated agents engage scammers to deplete their operational capacity, offers a proactive alternative but requires dynamic strategy adaptation that static systems cannot provide. We introduce a game-theoretic framework enabling LLMs to learn effective counter-strategies through in-context experience without fine-tuning. The framework models scammer-baiter interactions as a two-player game with empirically grounded strategies and utility functions, using Nash equilibrium as a formal benchmark for evaluating learned behaviour. Across 300 simulated dialogues and three LLM architectures, adaptive strategy selection achieves 28.9-79.7% closer alignment to Nash equilibrium than non-adaptive baselines. The code and an annotated dataset of 300 dialogues with turn-level strategy labels and utility scores are released at https://github.com/nardinebasta/GameofPhones_/ .
arXiv SWE-bench / Defects4J / arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsCollaborative AI for SEcs.LGcs.CLarXiv SWE-bench / Defects4JarXiv AI Coding 3Y
HarnessPro: Recursive Harness Self-Improvement with Pareto Optimization for Performance-Cost Trade-offs
Zhuoshi Pan, ZhiYuan Feng, Yukuo Cen, Honglin Lin, Junru Lu, Zhongxia Chen, Shuo Yang, H. Vicky Zhao, Jie Tang
2026/10/20 01:27已过 2 天
Harness development plays a crucial role in building capable AI agents. Recent approaches improve harnesses through recursive self-improvement (RSI), but their performance gains often come with higher execution costs. We introduce HarnessPro, a label-free method for evolving harnesses to improve task performance while reducing execution cost. In this setting, candidate harnesses are evaluated using LLM-generated tests without access to ground-truth solutions or official tests. Specialized agents diagnose execution trajectories, plan updates with different performance-cost priorities, and implement them as candidate harnesses. Rather than returning a single harness, HarnessPro uses normalized weighted squared-distance selection to provide cost-focused (lite), balanced (medium), and performance-focused (heavy) harnesses for different deployment budgets. Selected harnesses enter the next iteration, where execution feedback guides further updates. Our experiments cover Terminal-Bench 2, SWE-Bench Pro, and ProgramBench, using GPT-5.5 with Codex and GLM-5.2 with Claude Code. Across these benchmarks using GPT-5.5 with Codex, the heavy mode of HarnessPro achieves an average pass-rate gain of 2.0 percentage points and an average per-task cost reduction of 26.1% relative to RHO. This advantage also holds when using GLM-5.2 with Claude Code. Code is available at https://github.com/pzs19/HarnessPro
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
Proof-of-Machine-Learning-Inference: Mining Knowledge, Not Hashes
Wan Ki Wong, Michele Ciampi, Rik Sarkar
2026/10/20 00:45已过 2 天
Bitcoin-style Proof-of-Work (PoW) secures permissionless blockchains but spends substantial computation on hash puzzles which have no utility other than extending the chain. At the same time, we have seen that the rise of generative AI has created significant demand for computational resources that are unfortunately available only to a few players. We propose a solution that solves both problems at the same time. In particular, we present Proof-of-ML-Inference (PoML), a consensus protocol in which miners perform user-requested machine-learning inference as part of their consensus algorithm. We identify exactly what computational assumptions are needed for ML inference to safely replace hash work, formalize those assumptions, and give evidence that LLMs and diffusion models satisfy them. We then formally analyse the security of our protocol by reducing the security of our protocol to the security of the Bitcoin Backbone model. Finally, we empirically evaluate block-time stability, showing that, in a simulated environment, PoML maintains a block production rate close to its calibrated block-time target.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CVcs.CRarXiv cs.CR
BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting
Hao Chen, Junnan Xu
2026/10/20 00:28已过 2 天
Invisible watermarks are used to mark who owns a painting. We show that a simple attack removes the most robust one we test. The attack redraws the watermarked painting with brush strokes, using a pretrained stroke-based renderer. We call this attack BrushOff. It needs no training, no knowledge of the watermark, and no generative model. We test four watermarks on 500 paintings from five styles. VINE, a recent watermark built to survive image editing, survives all 14 conventional distortions we test, with at least 97.8% detection. Repainting lowers its detection to 1.8%, while the output keeps a no-reference quality score close to that of the clean paintings. Diffusion regeneration can also remove VINE, but at the same removal level it moves the image twice as far from the painting in DreamSim distance, and it changes what the painting shows. Because the renderer draws a countable number of strokes, we can control the attack strength step by step. Finally, we test what kind of signal survives. A simple probe that stores bits in the relative brightness of neighboring regions survives repainting, while a probe that uses absolute brightness does not. The same probe fails under diffusion regeneration, while VINE fails under repainting. Robustness to these two attacks is therefore a separate property, and benchmarks should test both.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.CRcs.ITarXiv cs.CR
DM-RSA-OAEP: Formal Treatment of a Dual-Modulus Fault-Detection Countermeasure Based on Physical Diversity
Ramamonjy Andriamifidisoa, Rufine Marius Lalasoa
2026/10/20 00:03已过 2 天
We revisit DM-RSA, an RSA variant that uses two independent moduli, whose original version was broken by Håstad's attack and contained an incorrect compromise-tolerance claim. We give a formal treatment of its repaired variant, DM-RSA-OAEP: (i) a complete IND-CCA2 security proof in the random-oracle model via a two-step hybrid argument, upper-bounding the security of the scheme by that of the weaker underlying RSA-OAEP instance, with an explicit simulation loss; (ii) a fault-detection theorem in an explicit adversary model that covers computation, key, and verification faults, including safe-error attacks, under a clearly stated physical-diversity assumption; (iii) an explicit analysis of why the countermeasure degrades to uselessness when the diversity assumption is violated (common-mode faults on a single chip). We position the scheme against the countermeasure landscape and against the broken dual-modulus literature. The contribution is deliberately framed as a fault countermeasure with a provable detection guarantee, not as a computationally stronger RSA. We conclude with a concrete instantiation and a detailed measurement protocol.
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEcs.AIarXiv AI Coding 3Y
Revision-Based Learning from Interactive Experience and Feedback
Jiawen Li, Chenming Ge, Alice Gao, Rishab Vempati, Yi-Hao Peng, Jason Wu
2026/10/20 00:01已过 2 天
Code generation models are increasingly used to produce interactive artifacts, such as websites and user interfaces. Many properties that determine whether these interfaces are useful only become apparent through realistic interaction, making them difficult to incorporate into model training. In this paper, we introduce RELIEF (REvision-based Learning from Interactive Experience and Feedback), a method for improving code generation models using feedback on their generated interfaces. RELIEF uses a coding agent to revise these interfaces, then incorporates the improvements into their original generation traces to produce supervision for fine-tuning. To evaluate RELIEF, we collected a dataset of 200 synthetically generated websites paired with 355 interaction recordings and accompanying feedback from 24 users. We used critiques derived from code inspection, automated interaction, explicit human feedback, and human interaction recordings to fine-tune variants of two code generation models. Our results show that feedback effectiveness varies with base model capabilities, with critiques inferred from human interaction recordings leading to the largest usability improvements overall under our tested models.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.CLarXiv cs.CR
Beyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM Jailbreaks
Rohan Menon, Chih-Hong Cheng
2026/10/19 23:36已过 2 天
Attack success rate (ASR) evaluates jailbreaks against large language models without accounting for repeated calls to the victim model. Yet each additional call gives the deployed system another opportunity to detect the attack and intervene. We introduce $\mathrm{ASR}_{\mathrm{STEP}}$, which penalizes additional victim-model calls while retaining binary success judgments. Our evaluation considers GCG~\cite{zou2023universal}, PAIR~\cite{chao2025jailbreaking} with a step budget, and a single-step PAP~\cite{zeng2024johnny} baseline on JailBreakBench across three model families. GCG's scores decrease by 7.0--8.7 percentage points after discounting, while PAP's remain unchanged. While for PAIR~\cite{chao2025jailbreaking}, we see a wider discounting range between 3.4-12 percentage points, showing that the "step" quantity differs per iterative strategy. Reporting both metrics makes the discount due to repeated victim-model interaction explicit. Code is available \hyperlink{https://github.com/SuELS-Group/beyond_asr}{here}.
arXiv cs.CRAI for Software EngineeringarXivapproachCollaborative AI for SEPrompt engineering for SEcs.CRcs.NIcs.OSarXiv cs.CR
Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier Rules
Ashok Subbabhatta Gopalakrishna
2026/10/19 22:36已过 2 天
AI agents in containers act by opening network connections, and the text that drives them can be hostile. Controls placed between the agent and its tools are bypassed by a child process or a direct socket, and their approval is not tied to the connection the kernel later opens. We present connection escrow: every outbound TCP connection from a supervised pod is parked inside the kernel's connect() path, before any packet exists, by a 98-instruction eBPF program on the pod's cgroup. A node interceptor attributes the held socket to its kernel socket cookie, process, executable digest, cgroup and pod identity, parks the first bytes the agent writes, and asks a verifier in a separate container with its own key. The connection is released only on a signed verdict naming that one socket cookie and destination, unexpired and unused; no verdict by the deadline resets it, and a late approval is refused. The agent is unmodified. A 36-check adversarial suite with real cgroups passes on the eBPF hold point (33 of the checks also apply, and pass, on an iptables hold point): refused connections never reach the destination; forged, rebound, replayed, expired and late verdicts are refused; the agent's attempt to reach the verifier is itself escrowed; child-process and renamed-binary bypasses fail; UDP is pinned to the resolver. On a Kubernetes cluster, unmodified pods are held per connection and attributed to their SPIFFE identity, a raw socket that bypasses a sidecar proxy is held, and 600 connections from six pods are gated. The hold adds 4.5 ms median per released connection, of which 24 us is policy. Finally, we gate on request content without terminating TLS: an eBPF uprobe reads the plaintext at the agent's TLS-library boundary (shared OpenSSL, static OpenSSL, Go crypto/tls), a model scores it, and the connection is held on that verdict while TLS stays end-to-end and the enforcer holds no key.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachVulnerability detection and software securitycs.CRarXiv cs.CR
Mal-AAEGAN: Adversarial Autoencoder with Double-Critic WGAN-GP for Malware Generation
Nam Hoang Thanh, Trung Pham Duy, Lam Bui Thu
2026/10/19 22:29已过 2 天
Machine-learning (ML) malware detectors are known to be vulnerable to adversarial samples. Generative adversarial networks (GANs) such as MalGAN, Mal-LSGAN, and our previous Mal-D2GAN can craft adversarial malware to probe and harden these detectors, yet they operate directly on a high-dimensional, discrete binary feature space, which leads to unstable training, vanishing gradients, and adversarial samples of limited diversity. To address these problems we propose Mal-AAEGAN. First, an adversarial autoencoder (AAE) learns a low-dimensional, regularized and continuous latent representation of the $M$-dimensional binary API feature vector, and the generator performs an additive perturbation in this latent space rather than in the raw binary space. Second, training follows the Wasserstein GAN with gradient penalty (WGAN-GP) scheme using two critics: a mimic-black-box critic that inherits the role of the substitute detector and a naive critic that inherits the role of the additional detector. A decode-binarize-OR pipeline guarantees that the original API calls of the malware are preserved. The model is evaluated on two malware datasets of different input dimensionality ($M\in\{139,215\}$) against eight common ML detectors and compared, under an identical protocol, with MalGAN, Mal-LSGAN and Mal-D2GAN. Mal-AAEGAN trains stably in the continuous latent space and attains an evasion rate on par with or higher than these binary-space baselines across both datasets, while its generator stays responsive to the noise input rather than reducing to a single fixed perturbation per malware.
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEcs.SEarXiv cs.SEarXiv LLM4Code / Program Repair
VerusEval: Evaluating LLM-Generated Verus Specifications Beyond Verifier Acceptance
Ding Wang, Chao Jiang, Dugang Liu, Zhiwu Xu, Cheng Wen, Zhong Ming, Yuwei Liu, Xinyi Wan, Lin Huang
2026/10/19 22:15已过 2 天
Large language models (LLMs) are increasingly used to generate Verus contracts for Rust programs together with the proofs that establish them. Yet verifier acceptance, the common measure of success, shows only that the implementation satisfies the generated contract, so it leaves open whether the contract captures the intended behavior. Assessing specification generation therefore requires an evaluation methodology, not a single metric. We present VerusEval, a framework that evaluates generated contracts along six dimensions, including Verus-native checks for semantic triviality, validated input-output (I/O) suites, and contract equivalence, and that relates them so that the strength and blind spots of each become measurable. Evaluating 13,716 artifacts from four workflows, five LLMs, and two prompting settings on 762 tasks, we find that acceptance overstates quality: only 42.3\% of the accepted artifacts complete all three semantic checks without a flag, and across workflows and models, higher acceptance does not consistently come with more correct contracts. I/O evaluation rejects 23.6\% of the accepted artifacts, yet only 63.2\% of those that pass it are proved equivalent. Of the accepted artifacts flagged by contract comparison, 84.1\% have a rejected completeness obligation, and the direction of a failure prioritizes inspection of the generated contract or the reference; it does not by itself establish which artifact is defective. Screening and review further identify 36 candidate defects among 61 selected reference contracts, and repairing one of them makes 10 of its 11 failing artifacts equivalent. Based on these findings, we derive four actionable lessons for evaluation, generation, and benchmark maintenance.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachempirical studyConfidentialityintegrityprivacycs.CRarXiv cs.CR
Differential privacy with adjustable preservation of multivariate relationships
Nicolas Ruiz
2026/10/19 22:11已过 2 天
This paper derives an exact attenuation formula for multivariate cross-moments under differential privacy achieved through randomized response. From a proposed alternative formulation of randomization matrices compliant with differential privacy guarantees we show that, under attribute-level randomization and where the randomization of the whole distribution is characterized by Kronecker products, any cross-moment of the anonymized dataset involving distinct attributes is equal to the original cross-moment multiplied by attenuation parameters, themselves determined by the part of the overall privacy budget allocated to each attribute. This characterization enables explicit and transparent controls of multivariate relationships preservations in differential privacy through privacy budget allocation. A simple numerical illustration demonstrates that identical total budgets can yield substantially different covariance-preservation profiles. The results also make the multiplicative loss of higher-order interactions explicit and thus can support mechanism design guided by analytical priorities.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
Exact Compilation and Resource Laws for Hidden Integer Feedback
Ganxuan Yang, Siqi Wen, Shuyan Yu, Jidong Yuan
2026/10/19 22:01已过 2 天
Hidden randomized rounding couples the privacy loss of successive integer releases. We study a rational-feedback mechanism under predictable signed-unit participation and full observation of every physical output. A preparation's lifetime connects three results. First, preserving complete carries until an observed echo synchronizes the worlds gives exact finite-law point compilation, with support-width exponent $3C-2$ at every fixed budget $C\ge2$. Second, releasing commitments earlier gives a monotone hierarchy whose exact endpoint, strict gaps and numerical brackets quantify calibration loss. At one fixed discrete Gaussian, a loss allowance of 0.09 requires all four commitments. Third, legal regeneration yields an unrestricted KL rate with a square-root testing remainder and a complete asymptotic frontier under joint physical-time and participation constraints. At fixed rational parameters, finite-window occupation programs approximate that frontier to error $2^{-b}$ in polynomial bit time in $b$. Verified countable-transcript semantics and independently checked finite certificates support these analyses. A matched static workload illustrates the resulting design tradeoff: a structured finite integer matrix improves error and fresh randomness, while the scalar feedback instance retains fewer noise-state and source-table bits.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CR
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Mengxiao Wang, Nitesh Saxena
2026/10/19 21:58已过 2 天
Large language model (LLM) agents now trade real capital using news as evidence, yet they cannot reliably tell fabricated headlines from real news. Because they read the same feeds under near-identical policies, a single fabricated post can push them into the same trade at the same moment. We present a systematic attack benchmark for information injection against LLM trading agents. Unlike prompt injection, which targets the model's instructions, information injection targets the evidence the agent trusts. The benchmark spans five injection vectors and seven event categories, evaluated over ~10,000 decisions on 15 U.S. stocks. Five findings emerge. (i) Prompt injection achieves 14% attack success rate (ASR), but fabricated news reaches 62% and two 30-word templates reach 100% on all 15 stocks, inverting the usual LLM-security intuition. (ii) For fact-poisoning templates, surface form matters more than content, since removing credibility cues such as a named source or a "BREAKING" tag drops ASR from 100% to 0% while the fake claim remains identical. (iii) Success depends on the agent's state, with a fake indicator panel scoring 91% against an agent about to hold but 12% against one about to buy. (iv) Attacks generalize across model vendors and remain effective when blended, unlabeled, into real news feeds. (v) Most attacks evade standard defenses, since model scaling stops shallow vectors but not fact poisoning, peer debate fails, and only hierarchical aggregation reduces ASR.
arXiv cs.SEEvolutionarXivapproachEvolution and maintenancecs.CLcs.LGcs.SEarXiv cs.SE
Co-Evolving Policy and Reward for Code Generation: A Mechanistic Study of Single-Adapter Drift
Amarsaikhan Batjargal, Noriko Tomuro
2026/10/19 21:48已过 2 天
Reinforcement learning with verifiable rewards (RLVR) is particularly well suited to code generation because generated programs can be objectively evaluated through execution. Execution also provides behavioral information that can be reused as additional supervision. The Synergistic Policy and Reward Co-Evolving Framework (SPARK), originally proposed for reasoning tasks, exploits this idea by recycling training rollouts and their evaluation results to train a model not only to generate solutions but also to evaluate and improve them. We investigate whether this policy-reward co-evolution approach transfers effectively to code generation and whether execution-grounded reflection provides an additional source of self-improvement. We compare SPARK-style rollout recycling with execution-only Group Relative Policy Optimization (GRPO) using Qwen2.5-Coder-3B-Instruct. Our results do not support either hypothesis under the configuration tested. Although co-evolution improves training performance, these gains do not generalize to held-out problems. Compared at the same stage of training, rollout recycling produces roughly 34x greater KL divergence from the reference policy than execution-only GRPO. Over training, trained tokens per GRPO sequence fall from 185 to 86 as training pass rate increases, while held-out performance declines or fails to sustain early gains. We characterize these patterns as single-adapter policy drift: the shared trainable parameters increasingly depart from pretrained code-generation behavior without corresponding gains in generalization. The results show that higher training reward alone is not evidence of generalizable code self-improvement and highlight the importance of held-out evaluation and drift diagnostics.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.CRcs.MMarXiv cs.CR
Temporal Dynamics and Security Assessment of SRT Protocol: A 96-Day Longitudinal Analysis of Production Streaming Infrastructure
Ahmed F. K. Koysha, Ferdi Sönmez
2026/10/19 21:43已过 2 天
This study presents a 96-day longitudinal analysis of Secure Reliable Transport (SRT) protocol behavior in a production streaming environment between Iraq and Turkey, examining 262,672 transport metric samples and 5,033,104 system resource measurements collected between October 2025 and January 2026. The research addresses temporal patterns, system-resource relationships, attack vulnerability, and anomaly detection. Results reveal significant temporal variation: Negative Acknowledgment exhibits 7.6-fold hourly variation and 11.5-fold daily variation (p < 0.001), though with small effect sizes (eta^2 < 0.04), indicating that temporal period explains less than 4 percent of total variance. Central Processing Unit (CPU) utilization emerges as the strongest system-level correlate of transport variation (r = 0.617 with NAK rate). Controlled User Datagram Protocol (UDP) flood experiments at 500 packets per second cause CPU increases of 176 to 806 percent, while SRT transport metrics change by only plus or minus 13 percent demonstrating protocol resilience through the Automatic Repeat Request mechanism. An unexpected anomaly reaching 97.7 percent CPU enabled signature-based differentiation between attack types. A Z-score anomaly detection method outperforms fixed thresholds, detecting all 7 security events. This study contributes the longest temporal characterization of SRT metrics reported to date, the first system-SRT correlation analysis, and the first controlled security assessment of SRT infrastructure. These findings provide actionable guidance for capacity planning, security hardening, and multi-metric monitoring of production SRT deployments.
arXiv cs.SE / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YRequirements and ModelingarXivbenchmarkapproachRequirements engineeringcs.SEcs.AIarXiv cs.SEarXiv AI Agents for Software Engineering
When Coding Agents Outpace Review: Evaluating PRD-Driven Development in Mature Enterprise Repositories
Tianqi Liu, Yandong Guan, Songze Li, Wenkai Wang, Gang Yu, Chengfei Lv
2026/10/19 21:39已过 2 天
Coding agents increasingly undertake development tasks in mature enterprise repositories, yet existing benchmarks offer limited insight into whether they fulfill complete Product Requirement Documents (PRDs) and where delivery breaks down. Issue resolution and development from scratch leave incremental PRD fulfillment underexplored, while isolated tests provide incomplete evidence of business and integration requirements. We introduce PACE, a benchmark of 43 enterprise tasks with 750 expert-audited Code Points. It combines requirement reconstruction, criterion construction, and evidence-based evaluation to measure PRD fulfillment and connect delivery gaps to agent behavior. Across 11 model--scaffold configurations, most scores fall between 52.1 and 78.1; GPT-5.6-Sol achieves the highest complete-delivery rate of 14.0\%. Incomplete implementation and missing integration are the principal bottlenecks: producing individual components does not ensure a complete delivery. Evaluation achieves 95.2\% agreement with expert consensus, with lower case-level variation across judging records than repeated executions. Beyond model comparison, the benchmark provides actionable feedback for harness refinement: diagnosis guides targeted improvements, and successive harness releases raise mean performance from 59.4 to 63.0 using the same model and task suite. Code is available at https://github.com/TianqiLiu1/PACE-Bench.
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachempirical studyAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsEfficacy measurement beyond traditional metricscs.SEarXiv cs.SEarXiv LLM4Code / Program Repair
The EBC Proportionality Law: A Recurring Architectural-Role Pattern Across Java Software
Dzikri Rahadian Fudholi, Andrea Capiluppi
2026/10/19 21:39已过 2 天
Architectural roles describe how responsibilities are distributed within software systems. Entity--Boundary--Control (EBC) separates domain information, external interaction, and workflow coordination, but its proportions across diverse software remain unclear. This study examines file-level classifier-derived EBC proportionality in 1,556,985 Java files from 732 project instances and 78 functional categories. A classifier trained on labels generated by a large language model assigned one representative role per file. The labels were aggregated at project and functional-category levels and analysed using descriptive statistics and density-based clustering. The results show that Entity was less common than Boundary and Control. The dominant cluster covered 48 categories, 472 project instances, and 47.75% of classified files; its mean composition was 13.25% Entity, 42.65% Boundary, and 44.10% Control. The remaining 30 categories form one alternative and 11 smaller specialised patterns. Some selected variations were consistent with category responsibilities, while others received mixed support. Agreement with independent expert labels was limited (31.37% accuracy; macro-F1 0.31; Entity recall 13%). All reported proportions and clusters are therefore patterns in classifier-assigned roles, not verified architectural ground truth. Within this measurement boundary, the study provides a large-scale empirical reference of EBC distributions at the file level, and it documents the limitations of the automated approach.
arXiv AI Agents for Software Engineering / arXiv SWE-bench / Defects4J / arXiv AI Coding 3YTesting and AnalysisarXivbenchmarkapproachempirical studySoftware testingcs.AIcs.CLarXiv AI Agents for Software EngineeringarXiv SWE-bench / Defects4J
VibeTraining-Bench: Data-Trainer-Harness Co-Design for Iterative System Improvement
Ruotian Peng, Yuanyi Ren, Shuaiqi Liu, Xin Guo, Fang Zhu, Yangyi Huang, Yue Wu, Zheng Wang, Yandong Wen, Zhihang Fu
2026/10/19 21:10已过 2 天
Recursive self-improvement (RSI) requires agents to diagnose system bottlenecks and coordinate improvements across training and inference. We refer to the agents' capability to jointly optimize training data, the trainer, and the inference harness as cross-component co-design. We introduce VibeTraining-Bench, a benchmark for evaluating this capability across tasks spanning terminal operation, software engineering, multi-turn tool use, and mathematical reasoning. Within each task, research agents start from an identical initial agent system under a fixed resource budget. Guided by validation feedback, they iteratively refine data, trainers, and inference harnesses, then select and submit a final agent system for evaluation on the test set. To prevent reward hacking, we enforce three safeguards: test data isolation, separate research and grading containers, and network restrictions for research agents. Our evaluation results show that frontier research agents substantially improve target agent systems. For example, on SWE-bench Verified, GPT-6-Astra raises the target agent system's performance from 32.9% to 53.7%, comparable to the human-developed instruct model's 55.4%. However, there is still room to improve their ability to co-design and iteratively refine data, trainer, and harness to achieve cumulative performance gains. We hope that VibeTraining-Bench will serve as a unified platform for advancing RSI, deepening our understanding of cross-component optimization for agent systems. Code and data are available at https://github.com/D2I-ai/VibeTrainingBench.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
Fortress: Fork Resistant Transparency logs Relying on Social graph Structure
Anastasiia Kucherenko, Melissa Chase, Esha Ghosh
2026/10/19 21:01已过 2 天
Transparency systems -- such as Key Transparency (KT), Certificate Transparency, and binary transparency -- require that all honest participants see the same view of an untrusted server's directory, or, failing that, that the misbehaviour is publicly detected. Every existing design closes this gap with an external trust anchor: a publicly available bulletin board (BB), a blockchain, or an out-of-band (OOB) gossip network among auditors. We observe that transparency systems already have a built-in resource that has so far been overlooked: the social graph induced by the users themselves. We ask whether it can replace the bulletin board or the external gossip channel entirely, and answer in the affirmative (if occasional out-of-band interactions are allowed). We formalise a new primitive, Social-Graph based Forking-Resilient Transparency (sg-FORT), which captures the security guarantees of a BB-free transparency system and we construct Fortress Fork Resistant Transparency logs Relying on Social graph Structure, to our knowledge the first such protocol. In every epoch either all users output the same post, or at least one honest user produces a publicly verifiable Proof of Misbehaviour. Our guarantees hold against an arbitrary malicious server, including a snapshot adversary that may compromise a user and learn its secret state, as long as the server does not compromise close users. In honest executions, OOB interactions occur only when a user resets their secrets, so the total OOB cost approaches the natural lower bound of one call per reset -- dramatically below the full-gossip alternative. We prove security under standard cryptographic assumptions on signatures and dictionary commitment. Under simplifying assumptions (synchronous epochs, always-online users), we view this as a first feasibility result that opens up the design space of social-graph-based transparency systems.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRquant-pharXiv cs.CR
Q-MALDetect: Quantum Image-Based Malware Detection and Adversarial Robustness Analysis
Walid El Maouaki, Mohammad Izen, Nouhaila Innan, Alberto Marchisio, Muhammad Shafique
2026/10/19 20:01已过 2 天
Quantum machine-learning (QML) models are increasingly considered for security applications, yet their adversarial robustness in malware analysis remains insufficiently understood. This paper presents Q-MALDetect, a hybrid convolutional and variational-quantum detector for byte-image representations of x86-64 Executable and Linkable Format (ELF) binaries, and evaluates it under feature-space and a range of Grad-CAM-guided, executable-aware evasion attacks. The model achieves 97.2% training accuracy, but its robustness deteriorates as attack strength increases, with the strongest evaluated feature-space attack reaching a 78.7% attack success rate (ASR). Among executable-aware attacks, Grad-CAM-guided no-operation (NOP) insertion produces the highest conditional ASR of 32.9%. Dynamic adversarial training is the most effective evaluated defense, reducing feature-space ASR to as low as 5.0%, executable-aware ASR to 7.7%, and the sequential-attack ASR to 34.0%. In contrast, convolutional-autoencoder preprocessing increases executable-aware ASR to 39.7%, coinciding with a rise in Grad-CAM attribution mass within the mutable .text region from 35.2% to 45.7%. Ablation results reveal no monotonic relationship between qubit count and robustness, while the encoding interface modifies the learned attack surface without neutralizing the strongest attack. These findings demonstrate that the effectiveness of attacks and defenses depends strongly on the perturbation constraints and evaluation conditions. Reliable deployment of QML malware detectors therefore requires assessment against both feature-space and executable-aware attacks rather than reliance on clean accuracy or generic denoising alone.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR
Signature Knowledge Shielding: Protecting Antivirus Detection Knowledge through Robust Embedding Matching
Jieshuai Yang, Zhi Wang, Yan Jia, Zhenhua Wu, Jianfei Tang, Chenbin Su, Jingwei Ye, Jianwen Tian, Wanpeng Li
2026/10/19 19:34已过 2 天
Antivirus (AV) signatures encode valuable detection knowledge accumulated through expert analysis, yet repeated black-box queries can expose this knowledge for unauthorized reuse and targeted evasion. We propose Signature Knowledge Shielding (SKS), a design paradigm that protects existing AV rules, termed Protected Signatures (PS), through auxiliary Shielding Signatures (SS). SKS uses AV-supervised importance ranking to discover candidate byte blocks, filters and selects them through negative-sample calibration, and combines SS matches with original AV verdicts through logical OR. SS matching introduces additional positive responses and verdict changes during probing, making detection feedback less directly attributable to PS and increasing the difficulty of localizing signature-related content, while preserving original positive verdicts. Within SKS, we integrate five individually tuned non-learning matching methods and further propose Robust Embedding Matching (REM), a lightweight learned matcher trained with random context and byte perturbations. REM provides stronger and more consistent protection against content modifications and scanning-alignment changes. We develop and open-source a ClamAV-based prototype and evaluate it against five probing methods. With an observed additional test false-positive rate below 0.1%, REM raises the mean query count of state-of-the-art probing to as much as 282.57 times the unprotected baseline, while introducing only 0.67% GPU scanning overhead. These results demonstrate that SKS can substantially increase signature-extraction costs with limited impact on detection utility and scanning efficiency.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.ROarXiv cs.CR
PhantomTac: Hijacking Robotic Tactile Systems with Deploy-and-forget Tags
Binbin Zhang, Yifeng Zhang, Xiaomeng Chen, Dongyao Chen
2026/10/19 19:03已过 2 天
Tactile perception is crucial for precise robotic manipulation, providing an important foundation for dexterous, closed-loop force control. Among various tactile sensing techniques, magnetic tactile sensors stand out thanks to their fine-grained, three-dimensional force perception capability and strong robustness against visual occlusion. In this study, we discover a physical loophole called PhantomTac in magnetic tactile sensors. The attacker can alter the magnetic field, thus spoofing the force interpreted by magnetic tactile sensors. The attacker can stealthily deploy such an attack by simply attaching a thin (the thickness is around 0.5 mm), battery-free magnetic tag to the surface of an object. Hence, the attack tag can be easily concealed by a barcode sticker. Such an attack scheme is "deploy-and-forget" -- the attacker can deploy the tag and leave. When a robotic hand is picking up an object, it may severely damage the object. Specifically, spoofing the normal force can crush the object, whereas spoofing the shear force can lead to a loose grip, thus dropping the object. Compared with directly sabotaging the robotic hand, PhantomTac is much more concealed as the attacker does not need access to the device. We performed extensive reverse-engineering efforts to characterize the sensing mechanism of commercial-off-the-shelf tactile sensors and proposed a practical tag design. End-to-end evaluations conducted on real robots and robotic arms demonstrate that our attack can bypass existing anti-interference mechanisms and effectively hijack their closed-loop control processes, achieving an attack success rate exceeding 95% when the grasping-position offset is bounded within 8 mm. Finally, based on the limitations of existing anti-magnetic interference mechanisms, we propose a multimodal-consistency defense mechanism to mitigate such physical-layer security threats.
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachPrompt engineering for SEcs.AIarXiv AI Coding 3Y
From Code to Playable Systems: CEGame-Bench for Long-Horizon Game Creation Agents
Zixuan Dong, Yanghai Wang, Hanyan Bian, Jiaxi Tao, Junze Li, Jiadong Wang, Xinyu Che, Lin Liu, Baoyun Peng, Xiaodong Wang, Jiaheng Liu
2026/10/19 17:59已过 2 天
A game ships when a player can launch it, finish it, and return to a saved world, none of which a successful build guarantees, yet game-creation agents are mostly tested on one engine or on one-prompt browser games. We present CEGame-Bench, the first long-horizon benchmark for complete-game creation across five production engines: Defold, Godot, Roblox Studio, Unity, and Unreal Engine. Agents build each game from an empty project and a design document in runs averaging up to 295 steps and 65M tokens; the document doubles as a contract, and a hidden evaluator accepts a game only by real-input play. Under four scaffolds, agents earn most integration points but usually under half the gameplay points, and their games reach the ending in only 16% of runs, while references built by engineers with coding agents score near the maximum, which places this artifact-to-play gap in the agents. No two engines rank configurations alike (Kendall's tau 0.14-0.62), and the same game usually scores higher on Unity and Unreal Engine, which check more before play. We release Game Completion Boost, an agent skill for requirement-driven playtesting and repair that raises the execution-based score of three models by 14.1-24.3 points.
arXiv cs.SEDependability and SecurityarXivapproachempirical studyFormal methods and model checkingcs.SEarXiv cs.SE
Function Contracts for Bounded Model Checking of C Programs
Weiqi Wang, Marie Farrell, Liping Zhao, Lucas C. Cordeiro
2026/10/19 17:51已过 2 天
Bounded model checking unrolls a program into a single formula, so a function holding a loop costs the solver a fresh copy of that loop at every call site. Function contracts break that coupling. Verify the body once against its contract, then replace each call by a stub derived from it. CBMC supports this through dynamic frame condition checking, applied at industrial scale, but with no formal account of why the replacement is sound and no characterisation of what the frame check costs. We present the function-contract framework for ESBMC. The clause syntax, both phases, and the first assigns enforcement the tool has had are all introduced here. Its technical core is an observational frame rule: snapshot the locations the contract does not permit the function to write, then compare them at exit. The encoding emits a number of verification conditions set by how many globals the program has, not by how many writes the body performs, while dynamic frame condition checking grows with the write count. That is a property of the encoding rather than a timing, so it moves with neither the machine nor the solver. The rule itself is the classical one; what we add is its bounded form inside a BMC encoding, with the pipeline's algebraic skeleton machine-checked in Lean 4 and the limits of that model stated. We evaluate on synthetic sweeps, SV-COMP tasks, an ANSSI X.509 parser, the FreeRTOS heap_1 allocator, and the ML-KEM reference implementation whose CBMC contracts we reuse unchanged. At the coefficient count FIPS-203 mandates, neither tool finishes on the monolithic route inside ten minutes, and both finish on the modular one. The framework is merged into ESBMC master. Contracts are what is left when unrolling runs out of room.
arXiv cs.CRAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.CRcs.LGarXiv cs.CR
LeakBench: Auditing Reward Hacking through Prediction-Time Leakage in Clinical Modeling Agents
Xiaoyuan Bao, Jingsi Jiang, Jiao Shan, Yulong Cao, Haoyu Wang, Zida Liu, Jun Gao
2026/10/19 17:50已过 2 天
Autonomous clinical-modeling agents can optimize predictive performance while violating conditions that make a model usable. We introduce LeakBench, an executable, guideline-derived audit suite that tests agent decisions for prediction-time leakage, calibration, site-level evaluation, support awareness, and decision-curve net benefit. LeakBench combines a synthetic task with known failure structure and two real-data settings: MIMIC-IV (430k admissions) and governed multi-hospital inpatient record front-page (MHFP) data. Our primary analysis uses reward hacking descriptively, without attributing intent: an agent selects prediction-time-invalid inputs because they improve its validation reward. A deterministic optimizer and every evaluated unconstrained local-model configuration select a fatal leaking feature. In fully logged September 2026 A/B runs, DeepSeek Flash and GPT-6-astra each leak in 10/10 unconstrained runs and 0/10 runs with an explicit admission-time constraint. This contrast is version-sensitive: a blinded Claude/Fable-5.1 chat run does not leak in either condition, while explicit-constraint violations appear only in a historical August 2026 slice lacking raw trajectories. Replacing AUROC with AUPRC does not remove leakage selection. Renaming or disguising the leaking inputs changes neither selection nor provenance-based detection; a name-based filter fails. A deterministic provenance verifier-in-loop removes the leak, making the LLM repair loop defense-in-depth. Specific verifier feedback clears fatal leakage in a hosted agent, and a three-seed ablation finds principle-only feedback clears decision-level defects, though these mitigation results are limited. LeakBench treats trustworthy clinical prediction as a property of an agent's modeling process, not merely its score; it is an audit testbed with known-failure controls, not yet an expert-validated benchmark.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.PLcs.CRarXiv cs.CR
Blame-aware Recomposition for Secure Compilation Proofs of Low-Level Compartment Isolation
Basile Schlosser, Jérémy Thibault, Catalin Hritcu
2026/10/19 17:16已过 2 天
The security guarantees of existing formally verified compilers for compartmentalized programs in unsafe languages like C stop at a rather high level, assuming a built-in protection mechanism and a block-based memory model. Verifying a concrete, low-level enforcement mechanism for compartment isolation is still a major challenge for current proof techniques. In particular, Abate et al.'s proof technique fails because one of their proof steps, recomposition, essentially requires hiding all information about the code of each compartment, which is not practically achievable at a low level. We propose an extension of their proof technique to a low-level setting where compartments can fully observe each other's code. To do so, we introduce an overlay semantics that allows us to characterize these observations as a form of undefined behaviour, and we use a novel variant of recomposition that we call blame-aware recomposition, which essentially allows recomposing executions as needed in the original high-level proof technique, even if the low-level context observes the code, because this context is ultimately going to be discarded. We apply this new proof to a compartment isolation mechanism that uses a programmable tag-based reference monitor.
arXiv cs.CRAI for Software EngineeringarXivapproachPrompt engineering for SEAutomating SE tasks with LLM and foundation modelscs.CRarXiv cs.CR
SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense
Yinxiang Wang, Zehua Ma, Kejiang Chen, Weiming Zhang, Han Fang
2026/10/19 16:36已过 2 天
LLM-based guardrails are effective against indirect prompt injection (IPI), but their performance depends heavily on model capability: as the guardrail model becomes smaller or weaker, detection degrades substantially. This raises a natural question: can we retain strong IPI defense while relying only on a small LLM? To understand why, we revisit what an LLM guardrail actually does. Detecting IPI requires simultaneously locating potentially injected instructions within heterogeneous tool outputs and judging whether they are authorized by the user's request. We find that the difficulty for small models arises largely from satisfying both requirements jointly, rather than from either subproblem alone. This suggests a different path to lightweight defense: explicitly decoupling localization from decision-making. In particular, localization needs no strong language-model reasoning, since injected instructions are often semantically discontinuous with their surrounding content and can be partitioned into local regions via lightweight unsupervised segmentation. Once the observation is partitioned this way, the remaining authorization check becomes a localized judgment that a small LLM can handle. Building on this insight, we design a lightweight IPI guardrail that performs attack-agnostic localization followed by block-level authorization judgment with a small language model. By separating where to look from what to decide, our approach substantially reduces the capability required of the guardrail model while preserving strong defense performance. Empirically, our guardrail achieves a 0.32% attack success rate with negligible loss in benign utility while remaining effective with substantially smaller models. These results show that strong IPI defense need not rely on strong LLMs when localization and decision-making are explicitly decoupled.
arXiv cs.SE / arXiv cs.CR / arXiv LLM4Code / Program RepairDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.LGcs.SEarXiv cs.SE
SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated Code
Mirza Masfiqur Rahman, MD Ajwad Akil, Imtiaz Karim, Ashish Kundu, Ramana Kompella, Elisa Bertino
2026/10/19 16:24已过 2 天
Code generated by large language models often passes every functional test while remaining insecure. These security hallucinations are common, written with high confidence, and repeated across samples, so neither the generator's own uncertainty nor static analyzers reliably catch them. We introduce SPLASH, which is guided by a new measure called audit pressure. It contrasts teacher-forced log-probabilities for the generated program under a security review and a style review. Aggregated to statements and programs, and grounded in a probabilistic model of competing edits, audit pressure allows SPLASH to choose the secure program among a model's candidate programs and locate the vulnerable statement, with no model training, CWE-specific rules, or internal access to the generating model. On 63,684 programs generated by 12 models for 899 tasks, SPLASH picks secure code in 74% of cases, places the vulnerable statement first in 58% of insecure programs, and chooses better than a frontier LLM judge.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.AIcs.LGarXiv cs.CR
NIOCIS: Typed-Decision Next-Hop Routing with Node-Conditioned Option Spaces for Tool-Use Agents
Jin Han, Mingfeng Xin, Feng Liang, Jingtao Yu
2026/10/19 16:10已过 2 天
Tool-use agents pay per decision: at each hop a language model re-reads the state and thinks for seconds, though its actions are finite and decisions recur. We present NIOCIS, a routing layer that folds execution logs into a loop-collapsed action graph (forward transitions plus recovery back-edges) answering one typed question: which declared option at a state, plus stop, does the fleet take next? A small model reads a calibrated distribution over them in one pass, emitting no text. On 1,615 production security-operations episodes we measure what the layer replaces, returns and is bounded by. Replaces: the typed encoder matches the logged next hop on 32.2% of the 3,875 held-out decisions (34.9% within the declared options) in 10 ms of encoder time (19.5 ms for the typed-choice form), against 2.2 s per LLM hop; two feature readouts reach 32.8% and 32.3%, an ordering the paired test does not resolve, so the typed layer is chosen for cost, not a separated lead. Tuning: jpt-4b reaches 9.9% zero-shot and 31.9% fine-tuned, a gap an exact paired test does not resolve (p=0.68), at 244 ms. Returns little: the realised hop falls outside the declared options for 7.9% of decisions and outside the model's top twenty for 9.3%; the most confident 15% holds 91.9% accuracy. Bounded: a cross-trace leave-one-out test puts the released state's ceiling at 25.6--44.9% as the state key grows more specific, i.e. repeated states disagree more often than they agree; the option-space ablation attributes the gain to per-node candidate restriction (+3.5 points over a flat catalog) rather than graph traversal (zero within its interval); a gated self-evolution loop lifts every arm above its anchor yet ends below full supervision; a confidence-gated cascade loses agreement when the escalation arm is the zero-shot stand-in; and agreement past a third of the fleet needs a state carrying the plan and the observation.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.AIarXiv cs.CR
Auditor-Assisted Summary-Channel Verification for Hosted LLM Identity Substitution
Ziyi Zhang, Ziyao Wang, Guoheng Sun, Ang Li, Jian Li
2026/10/19 16:09已过 2 天
Hosted LLM services increasingly expose model identity as a product claim, but external users and auditors often cannot inspect which model configuration served a request. We study an auditor-assisted regime in which a trusted auditor enrolls claimed identities and prepares verification material before deployment, while audit-time verification uses only the claimed identity and released output, without runtime access to model internals, inference logs, routing decisions, or provider metadata. We propose SUMMARK, a summary-channel watermarking framework that uses user-visible reasoning summaries as a keyed audit surface. During setup, SUMMARK constructs identity-specific vocabulary carriers, trains lightweight summary adapters, and calibrates per-identity thresholds. At deployment time, a keyed statistical test assesses whether the released summary is consistent with the claimed identity and, when needed, attributes the most likely enrolled identity. Across model families, scales, and task domains, SUMMARK reliably detects cross-family and cross-scale substitutions at low false-positive rates while preserving task-facing answer quality. We further study FP16->INT8/INT4 precision-consistency diagnostics and robustness under bounded post-processing, rewriting stress tests, and text-only spoofing, revealing both strong performance and clear failure boundaries. Our code is publicly available at https://github.com/trinitr0toluene/Summark.
arXiv AI Coding 3YDependability and SecurityarXivapproachempirical studyFormal methods and model checkingcs.ROcs.AIarXiv AI Coding 3Y
Policy Search in Code Space for Multi-Agent Pathfinding
Matthias Eder, Pantelis Emmanouil, Vivek Farias, Fabian Fischer, Adam Jozefiak, Tianyi Peng, Thomas Ulz, Raphael Watschinger, Fangyu Wu, Andrew Zheng
2026/10/19 15:39已过 2 天
Developing coordination policies for complex multi-agent systems relies on either labor-intensive algorithm design or opaque task-specific reinforcement learning. With recent advances in autonomous coding agents, we show that policy search directly in code space offers a compelling third path that combines automated optimization with explicit interpretability. We investigate a human-directed workflow in which coding agents iteratively propose, implement, evaluate, diagnose, and eventually refine algorithms guided by simulation feedback and explicit correctness verification. We conducted two case studies and found that this workflow robustly outperformed any manually engineered solutions. On a challenging map in the 2024 League of Robot Runners competition, a two-day search discovered a policy that exceeds the stronger locally reproduced competition entry by 35.0% on the densest instance and generalizes to unseen map instances. In simulated real-world warehouses with irregular lanes, continuous robot geometry, and asynchronous motion, a week-long search discovered an entirely new class of multi-agent pathfinding algorithm that outperforms a calibrated proprietary solution in throughput by 58.9%. Under stated assumptions, we further prove that the new algorithm is collision-free and completes, in finite time, every accepted goal that is not withdrawn or replaced. Together, the studies show that policy search in code space powered by state-of-the-art coding agents offers a highly competitive path to building real engineering solutions that are both effective and analytically tractable.
arXiv cs.CRAI for Software EngineeringarXivapproachPrompt engineering for SEAutomating SE tasks with LLM and foundation modelscs.CRarXiv cs.CR
RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
Yuchen Chen, Wei Cheng, Yuan Xiao, Junda He, Jieke Shi, PingPing OuYang, Quanjun Zhang, Chunrong Fang, David Lo, Zhenyu Chen
2026/10/19 15:32已过 2 天
Retrieval-Augmented Generation (RAG) enables large language models to access external knowledge during inference, but its reliance on external knowledge bases also introduces new attack surfaces. Existing data extraction attacks against RAG systems rely on either prompt injection, which heavily depends on the generator's instruction-following capability, or backdoors that reproduce or paraphrase retrieved documents but struggle to balance extraction fidelity and stealthiness. In this paper, we propose RAGLeak, a supply-chain privacy backdoor attack that decouples information leakage from direct textual exposure. When triggered, the generator reversibly obfuscates retrieved private documents for high-fidelity recovery by an auxiliary LLM. Across three model families and three application domains, RAGLeak achieves up to $100\%$ ASR with limited impact on benign utility and at most a $10$-percentage-point ASR drop under representative detection-based defenses. The backdoor remains effective after clean fine-tuning and across model scales and versions, revealing an underexplored supply-chain privacy risk in RAG systems. The source code is available at https://anonymous.4open.science/r/RAGLeak-4B67.
arXiv AI Coding 3YEvolutionarXivbenchmarkapproachEvolution and maintenancecs.AIcs.CLcs.LGarXiv AI Coding 3Y
EvoSkill v2: Fully Agentic Skill Evolution from Benchmark Adaptation to a Stateful Evolver
Dastin Huang, Baran Nama, Salaheddin Alzubi
2026/10/19 15:29已过 2 天
EvoSkill v2 is a three-agent system that edits the instructions (skills) an agent is given, leaving its model and harness intact. The user starts a run by describing a benchmark and supplying a grader, which a benchmark adaptor turns into a benchmark-specific plugin. A solver attempts the tasks, and an evolver reads the solver's training rollouts and rewrites the skills at each epoch. We implement the evolver as one stateful coding agent with a bash tool for the whole run, unlike the two most common designs among the skill optimizers we surveyed: a sequence of single model calls, as in SkillOpt, and an agent that starts afresh each round, as in SkillBoost. We also measure how much the solver's rollouts vary from one attempt to the next, give the evolver several attempts per training task, and accept every epoch's skills instead of selecting among them on noisy scores. With fine-grained ground truth, EvoSkill v2's skills raised the held-out pass rate above the stronger of SkillOpt and SkillBoost by 7.7 percentage points on SpreadsheetBench v2 and by 5.4 on $τ^3$-bench banking. In both benchmarks and both feedback settings, EvoSkill v2's evolver cost less per percentage point of held-out pass rate gained than either baseline's optimizer. EvoSkill v2 also enables a less capable model to improve its own skills, demonstrated by a gain of up to 21.5 percentage points in the $τ^3$-bench banking experiment where Claude Haiku 5.5 powers both solver and evolver.
arXiv cs.CR / arXiv AI Agents for Software EngineeringDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CRarXiv AI Agents for Software Engineering
Secure Agentic Coding through Counterexample-Grounded Feedback
Tue Le, Anh Nguyen Hoang, Gabriel Sasseville, Doseok Jang, Pierre-Luc Bacon, Nghi D. Q. Bui
2026/10/19 15:18已过 2 天
As coding models and agent harnesses become more capable, reliable security verification is becoming a central bottleneck. Improving secure code generation requires a signal whose reported progress remains aligned with actual program behavior under optimization; otherwise, an optimizer can improve the signal's verdict without removing the underlying vulnerability. Existing model-based approaches require models to either infer program behavior from source code or specify correct outcomes for adversarial tests, placing substantial reasoning demands on the security signal. We introduce \falcon{}, a counterexample-grounded verification framework that separates attack exploration from behavioral verification and connects them through execution traces of the program under test. In test-time repair, \falcon{} yields substantially stronger held-out functional-security gains than alternative security signals across secure code generation benchmarks, while preserving or improving functionality. As an RL reward, \falcon{} also outperforms static-analysis and learned rewards on held-out functional-security, even when all policies successfully optimize their respective training rewards. Combining \falcon{} with either proxy reward further improves held-out performance, suggesting that execution-grounded feedback can mitigate reward overoptimization while preserving useful guidance from existing security signals.
arXiv cs.SE / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachTrustworthy AI for SEcs.SEcs.CLarXiv cs.SEarXiv AI Agents for Software Engineering
SWE-Residual: Evaluating Starting-State Robustness of Coding Agents
Jinze Li, Weijie Liu, Jinfeng Xu, Shuo Yang, Xin Yang, Yang Zhang, Yijin Wang, Zifei Shan, Edith C. H. Ngai
2026/10/19 15:00已过 2 天
Software engineering (SWE) benchmarks are the primary way to measure the capabilities of coding agents: an agent is placed in a code repository or machine environment, given a request, and judged by hidden tests. These benchmarks almost always start the agent from a clean state that contains no earlier work on the task. In practice, however, agents often continue work that a developer or another agent has already done and reported as complete, with no indication of what remains incorrect or missing. We introduce SWE-Residual, a benchmark for Starting-State Robustness: the ability to maintain performance on a task when the starting state already contains earlier work on that task. SWE-Residual contains 198 Residual States drawn from 111 tasks in DeepSWE and Terminal-Bench, where the earlier work modifies a code repository or a whole machine environment. Each Residual State is the state a predecessor agent left behind after submitting its work as complete, although the hidden tests still fail. The evaluated agent receives only the original request and this state, without the predecessor's trajectory or any sign that the attempt failed; because the request and hidden tests are unchanged, the starting state is the only difference from the source benchmark. Across five frontier agents, success drops by 20.6--53.5 percentage points on DeepSWE and 20.6--34.9 points on Terminal-Bench relative to a Clean Start, and agent rankings on DeepSWE reverse. Failed continuations show a pattern we call acceptance bias: agents treat the inherited work as the definition of what remains to be done instead of checking it against the request. On DeepSWE, in 58.9--88.2% of failed runs, they submit with exactly the same tests failing, although they pass most of these tests from a Clean Start. SWE-Residual thus exposes a capability gap that clean-start evaluation does not capture.
arXiv cs.CRDependability and SecurityarXivapproachReliabilityavailabilityand safetycs.CRcs.CLarXiv cs.CR
Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online Feedback
Zhicheng Fang, Han Sun, Jiachen Lei, Xinyi Fang, Zongmin Zhang, Chenxu Fu, Sizhe Fang, Wei Xu
2026/10/19 14:54已过 2 天
As jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings. However, attack effectiveness is highly condition-dependent: an attack that succeeds under one victim-defense setting may fail under another, while exhaustively evaluating the full attack library for each setting incurs substantial token and monetary costs. This motivates studying how jailbreak attacks should be prioritized under a limited attempt budget for efficient robustness evaluation. In this work, we formalize this problem as budgeted attack scheduling over a fixed attack library and investigate three complementary signals under a fixed victim-defense condition: (1) static historical attack success rate (ASR) priors; (2) semantic guidance from LLMs; and (3) online feedback from earlier queries. Building on these signals, we design four scheduling strategies and evaluate them across three victim models and three defense settings on GPT-5.2. Extensive experiments clearly characterize the conditions under which each signal is most effective. Historical ASR provides a strong initialization, but its reliability degrades under defense-induced distribution shifts. Semantic guidance consistently improves or matches static prior-based scheduling in the cold-start regime, while online feedback becomes particularly valuable when transferred priors become stale. Semantic guidance and online feedback can also partially compensate for missing historical priors. Taken together, these findings characterize budgeted red-teaming as an attack scheduling problem in which historical priors, semantic guidance, and online feedback play complementary roles.
arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SECollaborative AI for SESustainable AI for SEcs.MAarXiv LLM4Code / Program Repair
Learning Who Talks to Whom: Role-Aware Communication Topology Scheduling for Efficient LLM Multi-Agent Collaboration
Haibin Li, Wenya Yu, Xuefeng Jiang, Jia Li, Xiao Han, Shuai Su, Wei Wei
2026/10/19 14:07已过 2 天
Multi-agent systems driven by large language models (LLMs) rely on structured communication topologies to facilitate information exchange and collaborative reasoning. However, effectively scheduling these topologies to dynamically determine who talks to whom and when to communicate remains a fundamental challenge in balancing collective reasoning performance against exponential token overhead. Existing topology scheduling approaches either enforce static communication graphs that cannot adapt to dynamic problem-solving states, or overlook agent role complementarity while failing to explicitly incorporate the synthesized graph structure into team-level decision evaluation. To tackle these limitations, we propose ACTS, a role-aware adaptive communication topology scheduling framework for efficient LLM multi-agent collaboration. Orchestrated within a Centralized Training with Decentralized Execution (CTDE) paradigm, ACTS introduces a novel dual-attention mechanism. Specifically, a Role-conditioned Relational Attention module dynamically selects variable-cardinality interaction partners based on agent roles and evolving execution states, while a Topological Attention Mixer explicitly embeds the directed communication topology into team value decomposition for precise credit assignment. Comprehensive evaluations across 9 challenging benchmarks covering code generation, multi-step reasoning, general knowledge, and competitive mathematics demonstrate that ACTS consistently outperforms state-of-the-art baselines, boosting average accuracy by up to 6.19 percentage points while reducing token consumption by over 15%. The project website is available at https://acts-mas.github.io/ACTS/.
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachEfficacy measurement beyond traditional metricscs.AIarXiv AI Coding 3Y
FrontierRefactor: Benchmarking Multi-Scale Performance-Oriented Codebase Refactoring
Shijian Wang, Fanqing Meng, Jiajun Chen, Qiguang Chen, Linxin Song, Runhao Fu, Shuhang Zheng, Shuai Shao, Qizhe Xie, Jieyu Zhao, Mengkang Hu
2026/10/19 13:47已过 2 天
Autonomous codebase refactoring requires coding agents to restructure working software while strictly preserving externally observable behavior and prioritizing execution performance and compute efficiency over stylistic preference. Existing benchmarks: refactoring benchmarks assess functional correctness while overlooking runtime regressions, whereas code performance benchmarks target isolated micro-kernels that ignore codebase-scale complexity. We observe that refactoring scale is governed by the scope of the observable contract, the caller-visible interface fixing behavioral invariants while freeing private implementations for optimization. Building on this insight, we introduce FrontierRefactor, a benchmark of 60 qualified engineering tasks spanning four scales, from computational kernels to full repositories, across in-place optimization and cross-language rewriting. Evaluating frontier coding agents through a reference-free cascaded protocol across 1,080 execution runs reveals that correctness and speedup are largely decoupled: 41.2% of submissions satisfy functional equivalence yet fail to deliver verified performance improvements, with 19.3% suffering performance regressions and 21.9% trapped in measurement noise. Refactoring paradigms reveal orthogonal engineering bottlenecks: while cross-language rewrites gain speedups from native compilation after passing functional checks, agents struggle with contract fidelity, with pass rates dropping from 65.0% on modules to 32.6% at package scale; conversely, in-place optimization reliably preserves behavioral contracts at 86.5% but rarely achieves acceleration without physical performance profiling. Trajectory analysis shows that agents fall victim to uncalibrated micro-benchmarking illusions, an operational blind spot that multi-turn execution-timing feedback directly resolves, raising strict success from 16.0% to 40.0%.
arXiv cs.SE / arXiv LLM4Code / Program Repair / arXiv AI Agents for Software Engineering / arXiv Program Repair Core / arXiv SWE-bench / Defects4J / arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachempirical studyAutomating SE tasks with LLM and foundation modelsAI-enabled recommender systems for automated SEcs.SEarXiv cs.SEarXiv LLM4Code / Program RepairarXiv AI Agents for Software Engineering
From Finding to Fixing: How Useful is Fault Localization for Agentic Program Repair?
Xinyu Shi, Zhou Yang, An Ran Chen
2026/10/19 13:43已过 2 天
Fault localization (FL) aims to identify code locations responsible for software failures and is commonly evaluated by how accurately it ranks known fault locations. Large language model (LLM) agents are changing program repair and are increasingly used to search and reason over repositories. Although recent LLM-based FL methods have improved localization accuracy, their impact on agentic repair remains unclear. To address this gap, we conduct a systematic empirical study of FL in agentic repair. We evaluate six recent FL methods on SWE-bench Verified and Defects4J with three LLMs under a common repair framework and analyze 16,248 repair trajectories. We also examine gold locations and bug-cause descriptions as forms of FL guidance across different repair contexts. The studied FL methods do not consistently improve repair success, and higher localization accuracy does not consistently lead to larger repair gains. Yet FL guides agents' early search and helps them reach relevant code sooner. Accurate locations can reduce repair token use by up to 39.2\%, but current FL methods often consume more tokens than they save during repair. Experiments with gold guidance suggest that FL has greater potential when bug inputs contain fewer location clues. Providing bug causes can further improve repair success beyond locations alone. We also find that ground truth from a single reference patch does not fully capture the locations used by successful repairs. These findings help clarify the value of FL in agentic repair and inform future work on its design and evaluation.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
PQC Migration of IPsec: Reliable Composite Key Sharing Mechanisms in IKEv2
Rahul, Manjesh Kumar Hanawal, Sameer G. Kulkarni, Tirumaleswar Reddy K
2026/10/19 13:10已过 2 天
The threat of quantum computers breaking classical cryptographic is accelerating the adoption of quantum- resistant cryptographic algorithms. Several government agencies have set a tight time-line for upgradation of all system to support post quantum cryptographs. We study post-quantum migration of IPSec protocols and their impact on network performance. The large key lengths in Post-Quantum Cryptography (PQC) cannot fit in a single IP packet leading to IP fragmentation. This can cause failure of security associations and degrade performance of IKEv2 under poor network conditions. To tackle this problem, we study a new key- sharing mechanism for IKEv2 and evaluate its performance. Unlike current hybrid key-sharing approaches, which send the classical and quantum keys sequentially over UDP or TCP (as in RFC 9370), the new approach concatenates them into a single composite key and transport them over TCP to ensure a reliable handshake. We implement and benchmark the new composite key-sharing handshake mechanism against existing hybrid algorithms that use either UDP or TCP. Extensive experiments under various network conditions demonstrate that the new approach significantly improves handshake time and energy consumption by avoiding the severe retransmission penalties of the Hybrid handshake mechanism. At 1% packet loss, the handshake time of composite key sharing mechanism is better by atleast 20% than hybrid mechanisms, and the improve- ment get better with higher packet loss reaching 30% at 10% packet loss. Energy consumption follows the same pattern achieving reduction of 29% at 10% packet loss
arXiv cs.CRDependability and SecurityarXivapproachReliabilityavailabilityand safetycs.CRarXiv cs.CR
Towards Architectural-Level Safety Control: Relocating Hazardous Knowledge into Removable Experts in Mixture-of-Experts Models
Cheng Jin, Zhongtian Ma, Xiao Wang, Han Qi, Xiaoyu Wen, Xiang Wang, Youbang Sun, Xia Hu, Bowen Zhou, Chaochao Lu, Qiaosheng Zhang
2026/10/19 12:55已过 2 天
Large language models acquire broad knowledge from web-scale corpora during pretraining, including knowledge that could be hazardous if misused. Removing such knowledge from the model itself without degrading general capability is desirable but difficult, as it is deeply entangled with general capability within the same parameters. Existing safety alignment and unlearning methods typically adjust these shared parameters, tending to suppress the expression of hazardous knowledge rather than remove it. As a result, the knowledge remains in the model and is readily recoverable by subsequent fine-tuning. To address this limitation, we propose REX (Relocating into Removable EXperts), a knowledge relocation method that separates hazardous knowledge from general capability at the architectural level. Exploiting the modular structure of Mixture-of-Experts models, REX expands the model with a set of new, physically removable experts designated to hold hazardous knowledge. Through expert expansion, selective gradient masking and routing differentiation, it relocates hazardous knowledge out of the original experts and concentrates it in the new ones. Excising these new experts yields a model suitable for public release. This removal holds consistently across Intern-S2, Qwen3.5-35B-A3B and Gemma-4-26B-A4B; on Qwen3.5-35B-A3B, for instance, excision lowers WMDP-Bio accuracy by 48.4 points while MMLU changes by less than 3 points. The excised model matches the strongest of nine unlearning baselines in removing hazardous knowledge, and it is the only one that preserves this removal under subsequent fine-tuning. After 250M tokens of standard fine-tuning on Qwen3.5, the best baseline rebounds on WMDP-Bio from 44.1% to 78.3%, whereas REX rises only from 32.4% to 42.8%.
arXiv AI Agents for Software Engineering / arXiv AI Coding 3YTesting and AnalysisarXivapproachProgram synthesiscs.AIcs.IRarXiv AI Agents for Software EngineeringarXiv AI Coding 3Y
OpenSaC: A Python Library for Search as Code in Deep Research Agents
Qi Liu, Jiaxin Mao, Fengbin Zhu, Tat-Seng Chua, Ji-Rong Wen
2026/10/19 12:46已过 3 天
Deep research agents investigate complex questions through iterative search, source examination, and evidence synthesis. A conventional workflow alternates reasoning with individual search and reading actions. Search as Code introduces a new paradigm: agents write programs that compose search, source reading, reranking, model calls, and local processing, returning selected observations for further reasoning. To support this workflow in existing coding agents, we present OpenSaC, an open-source Python library with a companion Search as Code skill. Configurable capability interfaces let agents combine these operations while retaining evidence for inspection and reuse. Compared with standard Codex using its built-in web search, the OpenSaC configuration uses less execution time and fewer model tokens on BrowseComp and WideSearch, with higher accuracy on BrowseComp and slightly lower row F1 on WideSearch. We aim to lower the barrier to adopting Search as Code and provide an open foundation for community development and transparent research on deep research agents.
arXiv cs.SEDependability and SecurityarXivempirical studyVulnerability detection and software securityConfidentialityintegritycs.SEarXiv cs.SE
What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software
Mahzabin Tamanna, S M Jamil Uddin
2026/10/19 12:38已过 3 天
The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyVulnerability detection and software securityConfidentialityintegritycs.CYcs.CRcs.HCarXiv cs.CR
When Care Expands and Control Declines: Understanding Digital Privacy in End-of-Life Care
Yibo Meng, Bingyi Liu, Lionel Z. Wang, Zhuoran Lu
2026/10/19 12:38已过 3 天
Terminally ill patients generate extensive digital health data through hospital portals, physiological monitoring devices, consumer health applications, and end-of-life care platforms. Yet their ability to control this data is systematically undermined by the structural conditions of terminal care. Through semi-structured in-depth interviews with 21 terminally ill patients, 11 family caregivers, and 8 physicians recruited from tertiary hospitals, this study examines the digital privacy circumstances and subjective attitudes of patients in end-of-life contexts. Thematic analysis reveals five structural dimensions of digital privacy challenge: continuous bodily digitization without meaningful informed consent; cognitive decline driving involuntary proxy control of accounts; inferential data generation exceeding patients' epistemic boundaries; dissolution of individual privacy boundaries amid relational network restructuring; and the absence of institutional governance over post-mortem data. Patient privacy attitudes span three profiles: fundamental absence of privacy awareness, sustained active management under severe tool constraints, and perception of problems followed by resigned abandonment. Interviews with caregivers and physicians reveal benevolent substitution in the name of care needs, expansion of access beyond the initial task, and unresolved boundaries under absent institutional guidance. These findings reveal a compounding privacy vulnerability unique to end-of-life contexts and call for privacy-by-design principles, granular permission mechanisms, and institutional governance frameworks tailored to the needs of dying patients.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.ITcs.CRcs.LGarXiv cs.CR
Fundamental Limits of Information-Theoretic Secure Aggregation with User Dropouts in Federated Learning
Jinbao Zhu, Kai Wan, Giuseppe Caire
2026/10/19 11:49已过 3 天
Secure aggregation enables a server to compute the sum of users' gradients or model updates without revealing individual values. With user dropouts, correlated random keys protect local gradients while allowing recovery of the desired gradient sum. We consider three phases: key distribution, masked-gradient upload, and mask elimination. Users establish correlated keys, upload masked gradients, and provide additional messages to eliminate residual aggregate masks. Existing information-theoretic schemes typically design mask-elimination communication for a prescribed dropout threshold and evaluate its cost under worst-case dropouts across the masked-gradient upload and mask-elimination phases. Such designs cannot adjust communication to actual dropout scenarios. Moreover, the randomness and communication costs of establishing correlated keys remain largely unexplored. To address these limitations, we formulate an adaptive secure aggregation framework under the T-colluding security constraint and construct a single scheme that supports all feasible dropout scenarios by adapting its communication to the actual number of dropouts. We establish converse bounds on four resources: key randomness, key-distribution communication, masked-gradient communication, and mask-elimination communication. The latter two bounds are characterized for each realized dropout set in the masked-gradient upload phase. The proposed scheme achieves the optimal masked-gradient communication rate for every feasible dropout scenario and the optimal mask-elimination communication rate in almost all feasible regimes. Its key rate and key-distribution communication rate are each optimal or within a factor of two of their respective information-theoretic optima. These results characterize the fundamental randomness and communication costs of secure aggregation with user dropouts.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.DCcs.NEarXiv cs.CR
Peer-Relative Trust-Guided Update Screening for Robust Semi-Decentralized Federated Learning under Label-Flipping Attacks
Ajay Kumar Shrestha, Sandhya Joshi
2026/10/19 11:04已过 3 天
Trust and reputation mechanisms can reduce the influence of malicious clients in federated learning (FL), but strict update filtering is difficult under non-independent and identically distributed (non-IID) data because honest local updates may temporarily reduce performance on a shared validation proxy. Building on our earlier trust-based semi-decentralized FL (SDFL) framework, this paper operationalizes the trust signals and introduces peer-relative update screening that combines a robust validation-utility score with direction- and norm-based update quality. The method is evaluated with 50 MNIST clients, 20% persistent label-flip attackers, Dirichlet heterogeneity levels of 0.5 and 0.1, 100 communication rounds, and five paired random seeds. Under moderate heterogeneity, the proposed method reaches 98.37% final accuracy while rejecting 95.82% of malicious updates and retaining 90.30% of benign updates; the final benign and malicious trust distributions are completely separated (KS=1.00). Under severe heterogeneity, it reaches 95.25% accuracy, rejects 88.55% of malicious updates, and retains 76.90% of benign updates (KS=0.96). Trust weighting alone preserves slightly higher utility in the most heterogeneous condition, but accepts all malicious submis-sions. The results therefore distinguish influence mitigation from explicit containment and quantify the utility-selectivity trade-off introduced by screening. The study provides an empirically validated off-chain governance core that can feed blockchain-based audit and incentive layers in SDFL.
arXiv cs.SE / arXiv cs.CR / arXiv LLM4Code / Program Repair / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YDependability and SecurityarXivbenchmarkapproachempirical studyVulnerability detection and software securityConfidentialityintegritycs.CRcs.SEarXiv cs.SEarXiv cs.CR
How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?
Haoran Xue, Nikta Akbarpour, Gias Uddin, Song Wang
2026/10/19 10:50已过 3 天
Large language model (LLM) coding agents, such as Claude Code, are increasingly used for security auditing, with task-specific skills providing reusable vulnerability-analysis procedures. However, their effectiveness in detecting real vulnerabilities and the reasons for their failures remain unclear. We conduct the first large-scale empirical study of 37 security skills using Claude Code with four underlying LLMs on 100 real Linux kernel vulnerabilities across ten classes, totaling 14800 runs. We evaluate vulnerability detection at the function, statement, and vulnerability-class levels. Results show that 24.4 percent of runs locate the correct function, 18.3 percent identify both the function and responsible statement, and 15.7 percent correctly classify the vulnerability. Our failure analysis reveals limitations in evidence acquisition, state-relation reasoning, code interpretation, candidate verification, investigation coverage, and reporting. Based on these findings, we propose SKILL-SIF, a self-improving framework that iteratively evolves security skills by learning from missed vulnerabilities and failure patterns. We evolve five top-performing skills using the original benchmark and evaluate them on 100 previously unseen vulnerabilities. SKILL-SIF improves fully correct vulnerability detection by up to eight times (from 2 percent to 16 percent) on unseen vulnerabilities, while aggregate accuracy across four LLMs increases by 1.85 times (from 6.05 percent to 11.20 percent). These findings highlight the limitations of existing security skills and demonstrate the potential of failure-driven skill evolution to improve vulnerability detection in coding agents.
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEPrompt engineering for SEcs.LOcs.AIcs.SEarXiv cs.SE
Beyond Leaderboards: A Method for Application-Specific Capability Profiling of Large Language Models
Oleg Grynets, Vasyl Lyashkevych, Andrii Salyk, Dmytro Koziuberda, Dmytro Kostetskyi, Oleh Kaskun, Olena Pochernina, Alona Seletska, Oleksii Ilchuk, Viktoriia Tsymbal, Daryna Tukalo, Bohdan Saukh, Ivan Fedorchuk, Hryhorii Petrenko
2026/10/19 10:05已过 3 天
Public leaderboards rank large language models (LLMs) in general, but an engineer has to choose a model for a specific application, architecture and cost. This paper presents a method for application-specific capability profiling of LLMs and its realization as a containerized testbed. The method treats each application as a unit of extension: an Oracle-to-PostgreSQL migration agent, a documentation-grounded chatbot or an enterprise-support automation agent runs in its own container behind a small contract, brings its own dataset, evaluator and owned attributes, and is onboarded together with its dashboards. Measurements accumulate in a versioned, sparse metamodel of every model. The method separates the model under test from judges and agents, freezes and hashes plans, refuses to compare values from different contexts, diagnoses the instrument before the system, and applies a null-agent check and a noise rule whose operating characteristics are quantified by simulation. In the evaluated automation conditions, model choices produced larger differences on selected observable outcomes than framework choices, although the experimental design does not establish a general causal ranking of these factors. The experiments also show that instruction tuning is deployment-specific and that system-reported success can exceed independently observed success: of 216 migration units checked against a real Oracle database, 108 were demonstrably correct. These measurements establish application-specific observations, not a universal model ranking.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.LOarXiv cs.CR
Formalization of Rényi Differential Privacy in Isabelle/HOL (Draft version)
Tetsuya Sato
2026/10/19 09:27已过 3 天
Differential privacy (DP) is a gold-standard definition of privacy designed to evaluate the privacy guarantee of databases. Rényi differential privacy (RDP) is an important variant of DP that gives tight evaluations of machine learning algorithms. These formulations are easy to understand, but evaluating privacy for actual databases is complicated. Even a small change in the database can break its privacy, and evaluations of DP and RDP themselves are complicated. In particular, RDP evaluations in recent studies have become much harder. Therefore, formal verification of them has been studied for over a decade. In this paper, we propose an Isabelle/HOL library for formalizing Rényi differential privacy in a general setting. We first formalize RDP for continuous distributions. As a technical basis, we formalize several properties of convex functions and $f$-divergences for nonnegative convex functions. We formalize basic properties of RDP, conversion laws from RDP to DP, the moment accountants in DP, and the Gaussian mechanism and its RDP. Finally, we discuss the stochastic gradient descent mechanism with Gaussian noise and formalize a rough evaluation of its RDP and DP.
arXiv cs.SEArchitecture and DesignarXivapproachArchitecture quality attributescs.SEcs.AIarXiv cs.SE
Selecting and Composing Agent Design Patterns: Industrial Case Evidence and Controlled Reference-System Experiments
Jia Huang, Bingsheng Ru, Bo Liang, Yuke Xiong, Haiyan Fan, Joey Tianyi Zhou
2026/10/19 09:10已过 3 天
Agent pattern catalogs describe architectural alternatives, but engineers also need evidence for selecting and composing them. We extend a cognitive-function--execution-topology framework with an evidence-driven selection procedure and explicit composition contracts. The study combines two industrial case accounts, a contributor's collaboration design, seven practitioner workshops, and executable fault-injection experiments. Three local reference systems use SQLite state, shared artifact files, and a file-backed map-publication surrogate. A 2 x 2 ablation separates function-specific contracts from execution controls across 36 scenario families, with ten input variants per family. Under equal family weighting, composition correctly completes or safely refuses 11 of 12 families in each system, compared with 2, 2, and 1 for the simple baselines. These are constructed challenge-suite results, not production success rates. Recovery without consumer-side verification increases false-success cases in the map surrogate. All composed systems still fail a boundary case in which trusted evidence is wrong. An audit of a frozen six-arm language-model pilot reproduces its scores but confirms an evaluator-dependent ranking reversal. The contribution connects industrial failure, pattern selection, executable treatment, external acceptance, and revision. Selection is demonstrated rather than evaluated against an alternative procedure; catalog admission rests on separate criteria. The results support bounded composition mechanisms, not a claim that the framework improves engineers' design decisions over an equally informative conventional method.
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SEarXiv LLM4Code / Program Repair
Better Specifications, Better Code: Fine-Tuning LLMs for Behavioral Contract Generation
Brhane Team, Tiantian Yang, Nikta Akbarpour, Simone Bartucci, Francesco Calimeri, Song Wang
2026/10/19 08:44已过 3 天
Large language models (LLMs) demonstrate strong code-generation capabilities but often struggle with functional correctness due to implicit or ambiguous behavioral requirements. We present CG2, a contract-guided code generation framework that translates natural-language tasks into structured behavioral contracts specifying interfaces, preconditions, postconditions, and invariants. CG2 fine-tunes an LLM to generate these contracts and introduces an iterative semantic validation and repair process to identify and correct incomplete, inconsistent, or incorrect specifications before guiding an unchanged downstream code-generation model. We evaluate CG2 on 1,007 held-out tasks using five code LLMs: DeepSeek-Coder-V2-Lite-Instruct, Ministral-3-14B-Instruct-2512, Qwen2.5-Coder-14B-Instruct, Qwen2.5-Coder-32B-Instruct, and Qwen3.5-27B. Results show that CG2 consistently improves pass@1 over direct code generation by 1.49-3.27 percentage points (7.58%-22.45% relative improvement) and over contract guidance without fine-tuning by 1.19-2.38 percentage points (7.04%-14.65% relative improvement). Manual analysis further reveals that semantically correct contracts are associated with higher code-generation accuracy. These findings demonstrate that explicitly specifying and validating behavioral requirements can improve functional correctness without modifying downstream code-generation models.
arXiv cs.SE / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivbenchmarkapproachempirical studyAutomating SE tasks with LLM and foundation modelsCollaborative AI for SEcs.SEarXiv cs.SEarXiv AI Agents for Software Engineering
Step-Aligned Script Generation with Verification and Recovery for Web Automation Testing
Hridya Dhulipala, Xiaokai Rong, Aashish Yadavally, Tien N. Nguyen
2026/10/19 08:07已过 3 天
Automated generation of end-to-end web tests remains costly: developers must identify stable selectors, encode multi-step workflows, attach assertions, and maintain scripts as interfaces evolve. Recent LLM-based web agents can complete natural-language tasks in a live browser session, but task completion is not the same as producing a test-ware artifact - code that is executable, replay-able from a reset state, inspectable by developers, and tied to an oracle. We present TESSARA, an adaptive test-script generation framework that converts natural-language test intent into Playwright scripts consisting of executable interaction code, goal-state assertions, and step-level provenance linking each step to its generated code fragment, selector evidence, execution outcome, and repair history. TESSARA grounds each planned step via Step-Aligned Scripting (SAS), enabling fine-grained failure localization, selective regeneration of failing suffixes, and reversibility-aware backtracking that avoids undoing likely commit points (e.g., form submissions). A three-level verification pipeline (syntactic, execution, and semantic/oracle), detects and repairs malformed code, interaction failures, and incorrect landing states. We evaluate TESSARA on three public web benchmarks, measuring script executability, oracle satisfaction, replay stability, and repair efficiency, and show substantial improvements over baselines and underlying VLMs used directly as script generators.
arXiv SWE-bench / Defects4JAnalyticsarXivbenchmarkapproachMining software repositoriescs.NEarXiv SWE-bench / Defects4J
Let Them Sleep: Recursive Self-Pruning Memory for Long-Horizon LLM Agents
Kargi Chauhan, Sadiba Nusrat Nur, Pratibha Revankar, Kyle Montgomery, Chenguang Wang
2026/10/19 05:56已过 3 天
Agents that run for a long time have a memory problem, and it is not the one most systems optimize for. Storing every trace and retrieving the nearest neighbors works early and quietly stops working later: the store fills up with failures the agent then repeats, and with facts that were true fifty turns ago. RSPM (Recursive Self-Pruning Memory) borrows the fix biology already found. At intervals the agent sleeps. It clusters its recent failures, distills each cluster into a short rule, and deletes the raw episodes it just learned from. Rules decay unless something reinforces them, and rules that recur across many contexts get promoted into general ones. We tested this on three settings with little in common: a difficulty-calibrated SWE-bench simulation, temporal consistency across 12 conversational benchmarks, and long-horizon QA on LoCoMo-10. All three improve, by 9.1, 11.9, and 7.6 points respectively. More interestingly, the two studies that instrument the store itself converge on nearly the same operating point without being tuned toward it: roughly 93% fewer retry loops and roughly 30% fewer stored entries. That hints that knowing what to forget is a general property of agent memory rather than a benchmark-specific trick.
arXiv SWE-bench / Defects4J / arXiv AI Coding 3YTesting and AnalysisarXivbenchmarkapproachSoftware testingcs.AIarXiv SWE-bench / Defects4JarXiv AI Coding 3Y
Editing as Language: Teaching LLM Agents a Grammar for Native Context Editing
Yunlong Deng, Yan Li, Xing Hu, Yida Zhu, Sean Du, Weiyang Liu, Guangyi Chen
2026/10/19 05:48已过 3 天
A synopsis in novels folds a story into a few lines; a function in code gathers many steps with a single execution. Context editing is native to language itself. In this paper, we propose the Native Context Editing (NCE) framework, which gives language model agents a grammar for natively editing their own context. By encoding context-editing operations in a grammar of dedicated special tokens, we teach the agents to invoke edits through the language itself. We train agents on iteratively constructed trajectory segments, with each teacher edit conditioned on the evolving context. This establishes context editing as an atomic and inherent capability of LLM agents, enabling them to dynamically modify their context as they generate responses over long-horizon reasoning and interaction. Compared with context-editing methods that learn to generate tool-use code within specific external harness environments, our approach integrates context editing as an internal mechanism of the model's native generation process, enabling better generalization across diverse real-world workflows. On four long-horizon agentic benchmarks (Terminal-Bench 2.0, SWE-bench Verified, SWE-bench Multilingual, and SWE-bench Pro), NCE improves the average task success rate over the base model by 5.6 percentage points for LongCat-Flash-Lite-Sparse and by 4.5 for Qwen3.6-35B-A3B, while reducing average token usage by 36% and 15%, respectively.
arXiv SWE-bench / Defects4J / arXiv AI Coding 3YDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.AIarXiv SWE-bench / Defects4JarXiv AI Coding 3Y
StopLoss: Teaching Agents to Predict Failure and Stop Early
Jiarong Liang, Xueguang Ma, Dongfu Jiang, Yuxuan Zhang, Ping Nie, Wenhu Chen
2026/10/19 04:39已过 3 天
Coding agents keep working on runs that will fail verification, and asking a frontier model to watch for this is expensive in its own right. We introduce StopLoss, a small external monitor that learns failure recognition from completed trajectories and their verifier outcomes. The name is inspired by the stop-loss order in finance: StopLoss ends a run early when the run is likely to fail, which saves resources. Final outcomes label earlier local windows, so a fine-tuned language model can score the most recent tool steps in a single forward pass, and a threshold calibrated on successful runs turns that score into an abort decision without changing the executor. Trained on GPT-family SWE-rebench trajectories and evaluated on SWE-bench Verified and a SWE-bench Pro subset with GPT and Claude executors, StopLoss is compared against six general-purpose judges reading identical windows. Outcome supervision lifts failure prediction from near chance to a useful signal at the first check, at one to two orders of magnitude lower cost per check than any tested judge. This translates into savings: relative to completing every task, StopLoss lowers cost per retained solve by 4.5\% on Verified while preserving 99\% of successful runs, and by up to 31\% on the costlier Pro subset, reaching 48\% with a Qwen3-8B backbone, and in all four settings its cost per retained solve is below that of every judge policy. Outcome-trained small monitors can make failure recognition cheap enough for early stopping to pay for itself.
arXiv SWE-bench / Defects4J / arXiv AI Coding 3YAnalyticsarXivbenchmarkapproachMining software repositoriescs.AIarXiv SWE-bench / Defects4JarXiv AI Coding 3Y
Bud ContextCompact 2.0: Context Compaction for Agent Success and Accuracy with Small Language Models and Constrained Context Windows
Jithin VG, Ditto PS
2026/10/19 04:15已过 3 天
Agents that work for many turns outgrow the context window of the model that serves them, and on small language models (SLMs) and constrained inference systems that window is small. Context compaction replaces older turns with a summary so a session can continue, but it is lossy, costs a model call, and can help or hurt depending on when it runs. We describe Bud ContextCompact 2.0, the compaction built into the Bud agent runtime, and evaluate it in two settings. On recall questions over recorded agent sessions, compaction to a 16K budget raised a 1.2B-parameter model's accuracy to 0.335, from 0.247 with truncation and 0.176 with its full 32K history (p < 0.001), and raised a 9B model from 0.515 (truncation) to 0.577 (p = 0.04). On 100 SWE-bench Verified tasks run end to end by a 27B reasoning model on a 49K-token window (556 graded sessions), compaction raised the resolve rate on long sessions from 41% to 53% (+12.3 points, 95% CI +1.6 to +23.0, McNemar p = 0.043), left short sessions unchanged, and used 13% fewer tokens per solved task at equal total cost. The main failure without compaction was not the history overflowing but a reasoning turn exhausting the room the history left. The gain has limits: it vanished under a 45-minute session budget, because each summary took a median of 161 s, and in a threshold study it appeared only when compaction triggered early enough to leave room. An 8B model submitted after about ten turns at 5-8K tokens and never needed compaction. We argue that the accuracy results transfer across hardware, including CPU inference, for an equivalent model and window, while the time cost scales with the hardware and must be budgeted for.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CRarXiv cs.CR
Adaptive Cyber-Defense for Evolving Attacker Capabilities using Reinforcement Learning and Behavior Trees
Nicholas Potteiger, Ankita Samaddar, Xenofon Koutsoukos
2026/10/19 01:22已过 3 天
Autonomous cyber-defense agents trained using reinforcement learning (RL) are increasingly adopted for defending enterprise computer networks. However, existing approaches may become brittle as attacker capabilities evolve and enable new attack strategies. In this work, we study the problem of adapting defender policies learned in CAGE Challenge Scenario 2 (CC2), a benchmark enterprise network defense scenario, to an extended network scenario with new attacker capabilities represented by new attacker actions. Effective attack strategies that leverage new actions are initially unknown, and therefore attacker policies must be learned before defender adaptation can occur. To address this challenge, we develop adversarial RL (ARL) with behavior trees (ARLBT), which uses reward behavior trees (RBTs) to define progression-based reward functions and condition attacker policies on RBT execution. The proposed RBT incorporates the new attacker actions into structured attack strategies while leveraging parallel execution to generate rewards across multiple network nodes simultaneously. We evaluate ARLBT for learning attacker policies against two baseline defender policies across network scenarios with different sets of new attacker actions and compare against multiple attacker baselines. The results demonstrate that ARLBT improves attacker success compared to ARL using the original CC2 reward function and that conditioning policies on RBT execution can improve sample efficiency. We further show that defender policies can be adapted against the learned attackers, improving robustness to attacks that leverage new attacker actions.
arXiv cs.CRDependability and SecurityarXivapproachDependability and security for embedded and cyber-physical systemsConfidentialityintegritycs.CRarXiv cs.CR
Spectrum of Liability: Forensically Sound Acquisition of Wireless Evidence for the Reconstruction of Maritime Cyber-Physical Incidents
Giacomo Longo, Alessandro Cantelli-Forti, Alessio Merlo, Enrico Russo
2026/10/19 01:09已过 3 天
Modern maritime navigation depends on mandatory wireless inputs, most notably GNSS and AIS, whose reception can be spoofed or jammed. When groundings or collisions occur, liability and safety investigations often turn on whether RF interference corrupted bridge instruments, yet the artifacts typically available (VDR outputs, IBS logs, screenshots, decoded messages) are downstream, lossy, and easy to contest in adversarial proceedings. We introduce a forensically sound acquisition methodology that preserves upstream wireless evidence together with the minimal contemporaneous context needed to interpret it. Our system records coherent, multichannel IQ across relevant bands while simultaneously collecting time-aligned receiver and instrument-state metadata (e.g., decoded AIS/GNSS outputs and NMEA sentences), enabling later re-decoding and physical-layer reanalysis tied to what the onboard stack indicated at the time. To make the record independently auditable, we package samples and metadata into a single append-only forensic envelope that cryptographically binds per-stream hash chains with trusted-time anchors and periodic checkpoints, allowing third parties to detect tampering (modification, truncation, splicing, cross-case substitution) and to verify the claimed recording window. A prototype implementation shows the approach is practical: integrity mechanisms add negligible storage overhead and modest compute cost at operationally relevant multiband capture rates.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger
Nanjun Zhou, Yiming Li, Yukun Chen, Ting Qiao, Enhao Huang, Zhan Qin
2026/10/19 00:23已过 3 天
Tool poisoning has emerged as a critical security threat to LLM agents, where adversaries embed malicious instructions in tool descriptions or external resources that enter the agent's context, allowing adversaries to manipulate agent's tool selection process. However, existing tool poisoning attacks primarily rely on an idealized assumption that the attacks task effect within a single interaction round. We show that their effectiveness degrades sharply in realistic multi-round agentic settings. We further reveal that this degradation stems from the fact that agents do not consistently surface attack-relevant signals in their reasoning as the planning context evolves, thereby weakening the attack's influence across rounds. To investigate whether tool poisoning remains a practical threat in such realistic settings, we propose SEAL, a two-stage method for persistent tool poisoning. Specifically, SEAL first performs Prefix-Eliciting Trigger Optimization (PETO) to optimize context-specific triggers that elicit attack-relevant reasoning prefixes, improving effectiveness within individual contexts. It then applies Local-to-Universal Trigger Aggregation (L2U) to combine these local triggers into a single universal trigger, improving generalization across different contexts and execution rounds. Extensive experiments across seven representative multi-round scenarios and different models demonstrate the attack effectiveness of SEAL, its transferability across target models, and its resistance to potential defenses.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachReliabilityavailabilityand safetycs.CRcs.LGarXiv cs.CR
GreenNIDS: A Benchmark Workflow and Analysis Dataset for NetFlow Intrusion Detection Experiments
Lilia-Eliana Popescu-Apreutesei, Sabina-Cristiana Necula
2026/10/19 00:11已过 3 天
Comparing the predictive performance and computational cost of flow-based intrusion detection experiments requires both quantities to be available for each run. GreenNIDS connects benchmark execution on public NetFlow datasets to a reusable analysis dataset. Model implementations write a common set of outputs, which are ingested into a run-level table with companion tables for model configuration, feature importance, and training history. The run-level table combines predictive metrics with timing, throughput, memory use, and energy estimates based on thermal design power. A CPU-only demonstration comprises 216 runs across four dataset families, three versions, and binary and multiclass tasks. Ingestion produces a 216 x 96 analysis table with no duplicate run identifiers and complete Matthews correlation coefficient (MCC) and F1 coverage. Multiclass ROC-AUC is missing for 36 PyTorch runs, making metric availability an explicit part of subsequent comparisons. The stored records support grouped performance and training-time plots, as well as resource screening after execution. Combining task-specific MCC thresholds with limits on training time, peak RAM, and estimated training energy retains 25.0% of the full run collection. These results establish compatibility within the evaluated collection and support comparisons after execution, subject to the recorded preprocessing, execution profile, and approximate energy accounting.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyFormal methods and model checkingcs.CRcs.ETarXiv cs.CR
On Pearl Blockchain's Proof of Useful Work: Systematization and Flexibility
Youlong Ding
2026/10/18 23:44已过 3 天
We revisit the proof-of-useful-work (PoUW) scheme in Pearl blockchain's white paper (Pearl Research Team), giving a systematic sensitivity characterization as an alternative to its Jackpot policy, along with efficient algorithm for verifying the sensitivity condition. Beyond its independent interest, our characterization yields a more flexible PoUW scheme that eenables miner autonomy: each miner can independently choose its noise magnitude to tailor the trade-off between computational accuracy and mining efficiency to its own needs.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.CRarXiv cs.CR
Equivalent Non-linear Shift Register Transformations and Espresso
Anirban Ghatak, Kaushik Sarkar, Anupam Chattopadhyay, Ambrish Awasthi, Indivar Gupta
2026/10/18 23:42已过 3 天
The stream cipher Espresso was designed by E. Dubrova and M. Hell as a hardware-efficient candidate for 5G security. It has two components - a 256-bit binary non-linear feedback shift register (NFSR), with 14 feedback taps, and a 20-variable non-linear output function. However, the security of Espresso with regard to several standard cryptanalytic attacks are estimated using an alternate NFSR, which has only two feedback taps. The above analysis is based on the claim that this alternate NFSR is obtained using a transformation algorithm which preserves the output sequence of the original NFSR. This issue has become all the more significant in the light of recent results on hardware performance evaluations, which assume that the stated equivalence holds. This article presents the first successful attempt in settling the above question of Espresso NFSR equivalence. We arrive at our main result by a careful analysis of existing transformation methods relevant to the question. In doing so, we first identify and correct a critical flaw in the proof of a foundational result of E. Dubrova. Next, in the context of Espresso equivalence, we analyze and unify the transformation framework of Dubrova and the one proposed by Yao and Parampalli. Based on our analysis, we have succeeded in transforming the LFSR in an Espresso-equivalent design reported by Yao and Parampalli to the Espresso alternate NFSR. Further, we have obtained a corresponding non-linear output function which achieves output-equivalence with the LFSR design, and hence, with Espresso.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CR
AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detection
Md. Emran Biswas, Md. Delowar Hossain, Mst. Tanbin Yasmin Tanny, Muhammad Aminur Rahaman, Md Al Amin, Tangina Sultana
2026/10/18 22:55已过 3 天
Attacks using ransomware have developed into complex multiphase campaigns that target vital infrastructure, resulting in annual damages of billions of dollars. Conventional detection techniques are ineffective against zero-day variations, and privacy issues are raised by centralized machine learning algorithms. Federated learning allows for cooperative model training without data sharing, however current FL approaches suffer from explainability issues, high communication cost, and non-IID data heterogeneity. In this study, we present AdaFedXplain, an explainable AI-based adaptive federated learning system for ransomware detection. Our approach includes progressive XGBoost complexity to avoid overfitting, a decaying learning rate schedule for stable convergence, and dynamic client grading based on ransomware prevalence and data sufficiency. Using 62,485 real-world ransomware samples from four OS-based non-IID clients, we compare AdaFedXplain against FedAvg, FedProx, and SCAFFOLD. According to experimental data, AdaFedXplain outperforms all baselines with 99.59% detection accuracy and 99.64% F1-score while cutting energy usage by 75%, latency by 65%, and communication overhead by 75%. The ablation investigation demonstrates that every element enhances performance. Security analysts can use SHAP explainability to identify important PE header characteristics that influence detection decisions. Our system provides a collaborative ransomware detection solution that is efficient and interpretable, while reducing privacy risks through federated learnings data-local training paradigm.
arXiv cs.SE / arXiv AI Agents for Software EngineeringTesting and AnalysisarXivbenchmarkapproachSoftware testingcs.SEarXiv cs.SEarXiv AI Agents for Software Engineering
From Software History to Executable Regression Tasks: A System for Evaluating Software Agents
Ruikai Shi, Zhengran Zeng, Rui Xie, Shikun Zhang, Wei Ye
2026/10/18 22:40已过 3 天
As software agents increasingly generate and modify code, evaluating their ability to review changes and discover defects becomes important. Such evaluation needs executable project environments for investigation and reliable defect references supported by reproducible behavior. Existing code review benchmarks provide limited support for this combination. We present a system that constructs executable regression instances from historical introducing--fixing commit pairs and developer tests. The system extracts candidate tests from fixing-side changes, then uses constrained agents to transplant them and configure version-specific environments while preserving production code and test expectations. Independent replay and evidence-based review verify whether tests that fail on the introducing version and pass on the fixing version support the proposed regression relationship. Accepted instances retain both versions' replay recipes, validated tests, and execution evidence. Repair-supported analysis and human review add root-cause locations, tested repairs, and causal explanations. These instances support bug detection and localization in code review, and enable bug repair and regression-test generation on the same defects. The system constructs 172 validated instances from 522 candidates across 11 Python projects. We evaluate three software agents with ten models and additional reasoning-effort settings on 83 manually selected, enriched instances across the three tasks. Precise root-line localization remains challenging, while baseline combinations achieve repair and regression-test generation success rates of up to 68.7% and 77.1%, respectively. Leading configurations differ by task, and higher task performance does not necessarily yield greater API-cost efficiency. Our approach provides reusable executable evidence for studying agents' defect discovery, repair, and testing capabilities.
arXiv cs.SE / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YAI for Software EngineeringarXivapproachCollaborative AI for SEcs.SEarXiv cs.SEarXiv AI Agents for Software EngineeringarXiv AI Coding 3Y
Beyond Similarity-Based Generation: Guiding Commit Message Generation with Issue-Commit Traceability
Chunying Zhou, Gong Chen, Xiaoyuan Xie, Yi Song, Yuxuan Yang, Peng He
2026/10/18 22:36已过 3 天
Commit messages provide records of code changes and help developers understand and maintain software. To reduce the manual effort involved in writing them, commit message generation (CMG) approaches automatically generate commit messages that describe code changes in natural language. Existing CMG approaches generally treat CMG as a standalone task and optimize generated messages primarily for similarity to developer-written references. However, this objective may not properly reflect the practical usefulness of generated commit messages. This limitation matters in current AI-assisted software engineering workflows, where commit messages are used as shared information to serve different software engineering activities. To fill this gap, we propose TraceMsg, which uses issue-commit traceability, a representative software engineering activity, to guide commit message generation. TraceMsg is a collaborative multi-agent framework that coordinates message generation, traceability reasoning, and feedback-guided refinement, allowing generated messages to serve traceability while using reasoning feedback to guide issue-conditioned refinement. We evaluate TraceMsg on six open-source projects. The experimental results show that TraceMsg achieves an average Hit@1 of 0.893 and an MRR of 0.911, improving Hit@1 and MRR by 13.16% and 38.75%, respectively, over the best baseline for each metric.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
PRICE: Privacy-Preserving Image Classification in Mobile Edge-Cloud Computing with Homomorphic Encryption
Duc-Huy Nguyen, Bui Duc Manh, Chi-Hieu Nguyen, Dinh Thai Hoang, Diep N. Nguyen, Van-Dinh Nguyen, Quoc-Viet Pham
2026/10/18 22:06已过 3 天
Cloud-assisted image classification enables many mobile AI applications, but transmitting raw images to the cloud raises significant privacy concerns. Homomorphic encryption (HE) allows computation over encrypted data; however, existing end-to-end HE-based inference pipelines incur prohibitive latency and computational overhead, limiting their feasibility for latency-sensitive mobile systems. This paper addresses how to enable efficient encrypted image classification in mobile edge-cloud environments without sacrificing accuracy. We propose PRICE, a three-tier edge-cloud architecture that partitions deep neural network inference between a trusted edge and an untrusted cloud. The edge performs lightweight feature extraction in plaintext, while only compact embeddings are encrypted using the Cheon-Kim-Kim-Song (CKKS) scheme and offloaded to the cloud for encrypted final-layer inference. This design avoids homomorphic evaluation of deep backbone layers, significantly reducing computation depth, ciphertext size, and end-to-end latency. To further improve efficiency, we develop RowHyDiag, a row-packed hybrid diagonal encoding with hoisted-rotation-aware encrypted matrix-vector computation, which minimizes rotation operations and improves slot utilization. Extensive experiments on real devices across five datasets demonstrate that, under the evaluated 128-bit-security configurations, RowHyDiag achieves up to 31.8$\times$ faster cloud inference, 85.3$\times$ fewer rotations, and 83.0$\times$ lower setup payload than the conventional Halevi-Shoup diagonal method. RowHyDiag also outperforms the PEGASUS linear-transformation baseline, providing 1.1-4.5$\times$ faster cloud inference and 1.2-3.4$\times$ lower setup payload. The results show that PRICE enables deployment-ready, low-latency encrypted inference for mobile edge-cloud systems under a trusted-edge threat model.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachempirical studyVulnerability detection and software securitycs.CRcs.DCcs.LGarXiv cs.CR
Federated Learning for Malware Image Classification under Data Heterogeneity
Victor Taiwo, Cemal Nisan, Muhammad Athallah, M. Emre Gursoy, Oznur Ozkasap
2026/10/18 21:34已过 3 天
Malware image classification (MIC), in which binary files are converted into visual representations and deep neural networks are trained to identify malware families, has recently emerged as an effective approach for malware detection. Federated learning (FL) enables malware image classifiers to be trained collaboratively by multiple clients without sharing raw data. However, a fundamental challenge in FL is data heterogeneity (non-IID), which is particularly relevant but understudied in the malware context. In this paper, we address this gap via three contributions. First, we present an empirical study of federated MIC under varying degrees of data heterogeneity across three popular malware image datasets (MalImg, Virus-MNIST, and MalNet). We show that while FL achieves strong accuracy under IID conditions, both accuracy and training stability degrade as data becomes increasingly non-IID. Second, we introduce a set of round-level statistics that characterize the data contributed by participating clients in each FL round, and demonstrate that class entropy (diversity of class labels present in a given round) exhibits strong positive correlation with global model accuracy. Third, leveraging this insight, we propose an entropy-aware client selection strategy that filters candidate client subsets based on class entropy, and show that our strategy outperforms standard random selection. Our results highlight the role of client composition in federated MIC and underscore the importance of distribution-aware classifier training under data heterogeneity.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CReess.SParXiv cs.CR
SemVideoSte: Agentic AI for Cross-Modal Semantic Video Steganography Communication
Rui Meng, Song Gao, Tingting Zhu, Zixun Tang, Jinke Ren, Xiaodong Xu, Pei Xiao, Shuguang Cui, Ping Zhang
2026/10/18 21:20已过 3 天
We propose an agentic artificial intelligence (AI)-driven cross-modal semantic video steganography communication (SemVideoSte) scheme for secure cross-modal information transmission. Agentic AI interprets the service context to determine a semantically matched public prompt and coordinates video generation, message embedding, semantic transmission, and message recovery process. A multi-mask mechanism combines variational autoencoder (VAE) reconstruction robustness, semantic transmission robustness, and latent separability to select reliable embedding positions. Meanwhile, a private digital token controls the random seed and guidance offset to construct positive and negative terminal latent states, enabling coverless message embedding during the final diffusion sampling step. Simulation results on open-source datasets demonstrate that SemVideoSte achieves high embedding capacity, reliable message recovery, and strong semantic consistency under different channel conditions. In addition, eavesdroppers without the correct digital token cannot reliably recover the secret message, and the generated stego videos effectively resist the steganalysis detection. We further establish a prototype testbed to verify the practical feasibility of SemVideoSte.
arXiv cs.SETesting and AnalysisarXivapproachempirical studysurveySoftware testingDebugging and fault localizationcs.SEquant-pharXiv cs.SE
Noise-Awareness in Quantum Software Testing: An Empirical Landscape Analysis
Mir Mohammad Yousuf, Shabir Ahmad Sofi, Bisma Majid
2026/10/18 20:54已过 3 天
Noisy Intermediate-Scale Quantum (NISQ) hardware has transformed quantum computing into a practical experimental platform while introducing fundamental challenges associated with hardware noise, decoherence, and probabilistic execution. Although quantum software testing (QST) has rapidly emerged as an active research area, it remains unclear to what extent existing testing methodologies explicitly engage with noisy and hardware-constrained execution environments. This paper presents a systematic empirical landscape analysis of noise-awareness in QST research through a deterministic, taxonomy-guided analytical framework applied to 61 papers published between 2018 and 2025 across eight testing paradigms, contrasting how contributions are framed with how they are evaluated. Among the analyzed papers, 47 (77.0%) are noise-oblivious and only 14 (23.0%) explicitly engage with noise-related execution concerns, while only 11 (18.0%) report evaluation on physical hardware or a noisy simulator. Test generation, the largest paradigm, exhibits a noise-awareness rate of only 14.3%, and debugging and repair 18.2%; coverage-based, metamorphic, and differential testing contain no noise-aware contributions. Noise-aware methodologies emerged late and remain outnumbered in all analyzed years. Framing and evaluation are strongly associated (odds ratio 40.5, p < 0.001) yet diverge for individual papers: 5 of the 14 noise-aware papers evaluate only on ideal simulators. Inferential statistical tests are reported in only 16.4% of papers. The classification framework was validated against a blinded, human-coded reference sample, achieving almost perfect inter-rater agreement on testing-technique classification and substantial agreement on noise-awareness. The framework provides a reusable empirical basis for longitudinal analysis of hardware-conscious testing practice.
arXiv cs.SE / arXiv cs.CR / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.CRcs.LGcs.SEarXiv cs.SE
Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use
Tianhe Lu, Sakuna Harinda Jayasundara, Eric Spero, Ewan Tempero, Robert Biddle, Giovanni Russello
2026/10/18 17:32已过 3 天
Cryptographic API misuse in large language model-generated code can compromise software security. While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored. To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories. Each pair changes a specified API decision while preserving the programming task. Subtracting the misuse program's internal representation from its secure counterpart's gives a repair vector. Across five models, comparisons of mean repair vectors reveal stronger organization by misuse category than by language. These category-specific patterns also support a shared intervention. We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories. With model weights fixed, adding one shared direction per model to its internal activations during generation improves aggregate target security rates by 5.28--15.00 percentage points over unsteered generation across languages and misuse categories. These findings connect the shared structure of cryptographic repair representations to a reusable intervention for safer code generation.
arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachempirical studyAutomating SE tasks with LLM and foundation modelsAI-enabled recommender systems for automated SEcs.LGarXiv LLM4Code / Program Repair
Memory as Belief: Bayesian Evolution of Memory for Self-Evolving LLM Agents
Yiming Xu, Qian Yang, Zihan Chen, Yuefei Wu, Wenhan Zeng, Bin Shi, Bo Dong
2026/10/18 16:49已过 3 天
Large language model (LLM) agents increasingly rely on external memory to accumulate past experiences for continual adaptation. However, effectively reusing memory requires accurately assessing its value, as retrieved experiences may become unreliable when transferred across task contexts. Despite its importance, memory valuation remains largely underexplored, with existing methods relying on historical retrieval success rates that overlook the context dependency of memory usefulness and the varying reliability of estimates under different amounts of evidence. Inspired by the Bayesian brain hypothesis, we propose BEAM (Bayesian-style Evolutionary Agentic Memory), a framework that reformulates memory value evaluation as a parameterized cognitive inference process, where memory value is represented as a context-conditioned dynamic belief rather than a passive historical statistic. Specifically, BEAM infers memory value beliefs from current task contexts and continuously calibrates them using execution feedback as empirical evidence, transforming memory from passive storage into an adaptive cognitive mechanism for continual self-evolution. Extensive experiments across reasoning and code generation benchmarks demonstrate that BEAM consistently improves memory utilization and enables continual self-evolution of LLM agents.
arXiv cs.CRDependability and SecurityarXivapproachVulnerability detection and software securityConfidentialityintegritycs.CRarXiv cs.CR
How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication
Eliron Rahimi, Margarita Osadchy, Orr Dunkelman
2026/10/18 16:47已过 3 天
Biometric authentication systems increasingly use privacy-preserving mechanisms to protect sensitive templates. However, the authentication interface itself may still leak information that enables reconstruction attacks. Prior attacks exploit released similarity scores, whereas more advanced systems reveal only the binary accept/reject decision. This binary feedback provides substantially less information, making template reconstruction far more challenging. In this work, we introduce query-efficient reconstruction attacks under extremely limited feedback, addressing two key limitations of prior attacks. First, we introduce the first attack that reconstructs protected biometric templates using only authentication success/failure feedback by exploiting the geometric constraints of biometric authentication. Second, we introduce distribution-aware query-efficient reconstruction methods for score-releasing systems, achieving a more realistic threat model by reducing the number of required queries by a factor of $5\times$ compared to recent prior score-based attacks. Finally, we combine these two insights by incorporating a pretrained facial diffusion prior into our geometric binary attack, reducing the number of required queries by a factor of $5\times$. Our findings reveal a fundamental security limitation of biometric authentication: independently of the template protection mechanism, the authentication process itself exposes geometric information that can enable perfect template reconstruction up to numerical precision. Moreover, the distribution of biometric templates can be leveraged to make significantly more effective reconstruction attacks.
arXiv cs.SEEvolutionarXivbenchmarkEvolution and maintenanceRefactoring and program differencingcs.DBcs.SEarXiv cs.SE
Which Code Changes Need Re-embedding? CIPBench and the Limits of Multi-Signal Index Maintenance
Nannan Zhao, Jiameng Zhang, Taoyu Zhong, Hao Wang, Bo Wang
2026/10/18 16:40已过 3 天
Repository-level retrieval-augmented generation systems must keep vector indexes synchronized with continuously evolving code, yet there is no principled basis for deciding which changed code units actually need new embeddings. We ask whether the retrieval impact of a code change can be anticipated before that embedding is computed. Across 10 open-source repositories in Python, Go, and JavaScript, we characterize how a change propagates from syntactic substantiality through embedding displacement to retrieval impact. The links are informative but not deterministic: syntactic class separates displacement sharply, yet impact depends on a unit's retrieval exposure as much as on how far its representation moves, and recurring counterexamples bound what any single signal can decide. We formalize the decision as CIPBench, a benchmark that scores maintenance policies under a strict pre-embedding information boundary. Prediction works, and one signal exhausts it. A ranker using only a unit's change history substantially reduces retrieval harm relative to random and recency-based scheduling. Combining it with three further signals--individually discriminative and largely unassociated with one another--leaves the decision statistically unchanged across every budget we evaluate, for reasons we trace to the structure of the score rather than to its tuning. What pays off is not ranking but filtering: units whose text is unchanged from the indexed state can be skipped with no risk and, in the most reversion-heavy project, at nearly half the embedding cost. Signal-level informativeness is therefore not evidence of decision-level value, and separating the two requires evaluating the decision a signal produces rather than its association with the outcome.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
Towards End-to-End Privacy-Preserving AI for Real-Time ECG Monitoring
Beyazit Bestami Yuksel
2026/10/18 15:58已过 3 天
Healthcare artificial intelligence is shifting from centralized archives toward distributed pipelines that combine wearables, edge processing, cloud analytics, and multi-institutional learning. In this regime, electrocardiogram (ECG) streams cross multiple trust boundaries, so privacy cannot be reduced to a single transmission control. Existing privacy-enhancing technologies typically secure isolated stages and leave gaps between acquisition, analysis, and institutional collaboration. This doctoral research develops a unified lifecycle framework for end-to-end privacy-preserving ECG AI. Rather than introducing another privacy mechanism, it orchestrates complementary privacy-enhancing technologies across the clinical ECG lifecycle, allocating each mechanism to the trust boundary where its security, computational, and operational properties are most appropriate. Three interoperable modules instantiate the framework: AES with CKKS-based homomorphic statistics for secure monitoring; adaptive chaotic protection for low-latency edge transmission; and federated learning with homomorphic aggregation under heterogeneous partitions. Across prototype monitoring, signal-security analysis, and simulated collaboration, the programme shows that privacy layers can be composed without collapsing diagnostic utility, while exposing overhead and fidelity limits that constrain clinical translation.
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR
Locate, Then Reason: End-to-End Patch Presence Testing in Stripped Binaries
Huaijin Wang, Tongda Wang, Zhibo Liu, Yue Zhang, Shuai Wang, Pengfei Hu, Jianzhong Liu, Fangtian Zhong, Shaohua Wang
2026/10/18 15:27已过 3 天
Binary patch presence testing (PPT) determines whether a security fix is present in a stripped binary. Prior systems often assume that patch-relevant code is known or successfully matched. Function-level matching is brittle to compilation changes, inlining, finite model context, and missing usage context; moreover, similarity suppresses the patch-sized distinction needed for the verdict. We present PatchAlign, an end-to-end binary PPT workflow, which performs large-scale localization that maximizes recall economically, then the final verdict reasons for patch-specific evidence. PatchAlign uses instruction-aligned retrieval and caller-callee context to accurately locate patch-relevant binary code pieces, then screens the shortlist and compares target binary code with vulnerable and patched references using an LLM. Our experiments indicate that PatchAlign can precisely localize patch-relevant code and determine patch status without a target-location oracle.
arXiv AI Coding 3YAI for Software EngineeringarXivapproachPrompt engineering for SEcs.AIarXiv AI Coding 3Y
One Skill Takes Over: Clashing Agent Skills and a One-File Fix
Parsa Razmara, Seyedarmin Azizi, Ardalan Aryashad
2026/10/18 15:11已过 3 天
Agent Skills are instruction files that tell a coding agent how to do one job. Users install skills from many authors, so two skills for the same job can be active at the same time. We ask what a model does when both skill files are in its context: does it combine their compatible rules, or follow one skill and drop the other? We build SkillClash, 16 pairs of same-job skills in which code checks every rule and a reference output shows the best result that can be reached. On seven models from five families, from 4B open models to Qwen3-235B and GPT-4.1, a skill's rules are followed 93 to 99% of the time when it is loaded alone and 61 to 62% when a same-job skill is loaded next to it. Most outputs show takeover: every rule that only one skill asks for is followed, and every rule that only the other skill asks for is dropped. The worked examples inside the skills drive this. When each skill file instead ends with one example that follows both skills, takeover falls to 1 to 15% on the six models we tested. Telling the model which skill has priority does not bring the dropped skill back, and telling it to apply both skills brings the dropped skill back only on the two strong models and leaves the interacting rules broken. One merged skill file written by the strongest model we used, Claude Opus 5.5, lets all seven models follow 96 to 99% of the achievable rules. Most of its gain over a plain list of both skills' rules comes from its one worked example, and such an example helps only when it is correct. Code and data: https://github.com/prazmara/skillclash
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachReliabilityavailabilityand safetycs.LGcs.AIcs.CLcs.CR
Policy Is Not Capability: Some Safety Benchmarks Measure Which Definition of "Unsafe" You Trained On
Vahid Jebraeeli, Jonathon Romero, Yijin Wang, Adrian Chan, Jianbang Zhang
2026/10/18 15:02已过 3 天
A guardrail classifier is reported as if unsafe were a property of text. It is not: it is a property of a policy, and the policy enters the model through its labels. We exploit an accident of an industrial deployment in which the same ~53k prompts were labelled twice, under two operational definitions ("is this a request for harmful content?" and "would a moderator block this?"), and used to train ten guardrail arms sharing architecture, codebase and optimiser family, at two model scales. First, the guardrail's own training corpus already contained the benchmarks: JailbreakBench-benign is 88% and OR-Bench-hard 82% present in the training pools, two over-refusal benchmarks, the kind a guardrail reports to argue it does not over-block. Everything below is decontaminated. Second, safety benchmarks stratify sharply by how much of their score is decided by the label definition rather than by the model: with architecture and optimiser fixed, the range across the ten arms is 0.99 on HarmBench-copyright and 0.043 on WildGuard-benign, a 23x spread. Third, a benchmark score can be moved across its entire range by 0.03% of the parameters. Across these arms HarmBench-copyright spans 0-100 and OR-Bench-hard over-refusal 3.4-56.4%, and the four arms whose last supervision signal carries a given policy occupy one extreme of both (exact rank p=0.005, or 0.04-0.14 at worst), at unchanged detection capability. For a distilled student the teacher's soft labels do this even when every hard label carries the other policy, so teacher provenance is an unrecorded confound in any released checkpoint. Fourth, validation accuracy on the one split that grades all twenty arms tracks agreement with the annotator's policy (rho=+0.74), not detection capability (rho=+0.34). We argue that guardrail evaluations should report contamination, a seed floor and the definition they were graded against as first-class variables.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR
Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication
Daksh Pandey, Sayon Duttagupta, Xinhai Zou, Amit Singh Bhati
2026/10/18 13:43已过 3 天
An AI agent can reproduce the distribution of its messages and of the receiver's task outcomes while disclosing private information that the task never required. We ask what a passive audit can certify when the auditor knows the authorised sender and the exact observable law but has no trusted pairing of messages with the private states behind them. For a single round, compatible mutual-information leakage forms a sharp interval, and fixing the entire task-relevant message law, with every declared task utility, can still leave a full private bit undetermined; total leakage is determined if and only if, in every task state, the remaining private state or the authorised message is a deterministic function of that state. For a sender, such as an LLM, that selects among its own responses, we prove that in a balanced case its change to the message law within each task state equals $(1-2^{-k})$ times the honest messages' dependence on the attribute, which also sets, up to a constant, how many messages a monitor needs. With Qwen2.5-1.5B-Instruct on a synthetic routing task, selection among 16 responses lets a public decoder recover a private bit in all 8,192 held-out rounds at 98.60\% routing accuracy (honest sender 98.90\%). A monitor that knows the selection rule reaches AUC 0.645 on single messages, close to the ceiling of 0.671 that honest messages predict, and 0.972 over 16, while generic monitors stay near chance. A law-preserving sender built from the same samples recovers the bit in 97.7\% of rounds, and every monitor without the true bit stays near chance against it. A canonical task interface preserves every receiver decision and bounds the remaining information about a balanced attribute by twice the routing-error rate, even for a receiver that shares a key with the sender. These results distinguish what passive auditing can certify from what restricting communication can enforce.
arXiv AI Coding 3YAnalyticsarXivapproachMining software repositoriescs.LGcs.AIeess.SYarXiv AI Coding 3Y
LLM Agents as Suppliers of Physical System Models: Calibration and Acceptance in Modelica
Jörg Frochte, Herbert Schmidt
2026/10/18 13:00已过 3 天
To procure a model of a device, a client hands a supplier a description, sometimes with recorded data or a target response, and accepts the model against this handover. We let LLM coding agents act as the supplier on handovers with data, building Modelica models from library components for four simulated systems and a real switching magnet, and ask what acceptance certifies. Several agents reach the noise floor, but a handover admits a set of models: the description leaves parts of the structure open, and the data narrow it only to the agreed accuracy. We therefore accept by membership in this set, not by matching one reference, and add layers above behaviour: a physical invariant exposes an energy-creating model at the noise floor. Interpretability becomes a property of the delivered model, tested on a variant, read where none exists and shaped through the handover. Most failures are fits delivered with a systematic residual on their own fitting data, where the handover left open how close is close enough. In a follow-up, stating a threshold makes the agents compare against it, and more deliveries pass. The argument applies wherever a handover underspecifies a model meant to be read, not only run.
arXiv cs.CRAI for Software EngineeringarXivbenchmarkapproachempirical studyPrompt engineering for SEAutomating SE tasks with LLM and foundation modelscs.CRcs.CLcs.LGarXiv cs.CR
SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space
Stavros Damianakis, Konstantinos Psounis
2026/10/18 12:07已过 4 天
Prompt injection is the dominant security risk for large-language-model (LLM) applications and agents, yet the field still lacks a coherent map of how these attacks are constructed. More than twenty public datasets describe prompt injection using incompatible vocabularies, often organized around delivery vector, attacker goal, or generation method. In this Systematization of Knowledge, we present PIAtlas, a taxonomy organized instead around how the injected instruction is constructed to subvert the underlying model. Its six classes, one per subversion mechanism, form the roots of a hierarchy of techniques and sub-techniques that researchers can use to describe attacks consistently and design more systematic evaluations. We derive the taxonomy from how LLMs are trained, prompted, and influenced by human-like framing, and compare it with historical attack data. To ground this comparison, we release PICorpus, to our knowledge the largest license-clean collection of public prompt-injection datasets, and map thousands of its records to PIAtlas under a human-verified protocol. The mapping shows that attacks usually combine several techniques drawn from only a few mechanisms. It also reveals gaps that existing labels obscure: widely used agent benchmarks test only part of the attack space, and adaptive attackers favor mechanisms that curated benchmarks underrepresent. PIAtlas thus provides a common foundation for understanding this attack space, improving benchmark coverage, and guiding red teaming and defenses.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.DCcs.CRarXiv cs.CR
Hierarchical Rule Auditing with Exact Ternary GPU Correlation
shengwei wang
2026/10/18 11:58已过 4 天
Auditing firewall logs against requirements mapped to controls and frameworks must retain overlapping obligations, preserve uncertainty from missing attributes and count distinct affected records. Direct, bitmap and relational methods can express this audit; a correlation implementation must preserve distinctions that ordinary match counts and rule-hit totals discard. We present an exact ternary correlation algorithm that compiles categorical conjunctions into one bounded-integer matrix product. A dominating false-predicate penalty separates known mismatches from missing evidence, while per-record hierarchy unions prevent duplicate counting. We prove their composition and handle high-cardinality endpoints through exact address classes and versioned labels. Evaluation compares eight CPU/GPU implementations, includes public traffic and 133 published source-address ACLs with generated observations, and measures hierarchy and policy-rebuild costs. On an NVIDIA L4, matched fused execution reduces latency by 8.8 to 11.2 percent relative to two-product correlation across five tested shapes. At 100,000 records and 1,024 requirements, it takes 12.28 ms versus 13.82 ms for two products and 12.29 ms for GPU bitmaps. Bitmaps remain faster in most regimes, with hierarchy operations and reductions dominating the measured fused-correlation stage intervals.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.DCcs.CRarXiv cs.CR
BitPCE: Batched Multi-Dimensional PolicyResolution with GPU Bitmap Algebra
Shengwei Wang
2026/10/18 11:10已过 4 天
Policy controllers must determine which workloads match rules spanning several label dimensions. Hash sets, compressed bitmaps, and GPU set-processing primitives address the underlying set operations. However, intermediate results, repeated scope evaluations, dependent policy updates, and host transfers can dominate the cost of a heterogeneous batch. We study this problem as batched intersection-of-unions (IoU). Our design exploits independent scope--word tasks, reusable endpoint expressions, and policy dependencies. The challenges are preserving wildcard, empty-group, and exclusion semantics, recognizing equal scopes, and retaining unchanged recipients affected by source edits. BitPCE addresses them with register-resident GPU evaluation, canonical scope compilation, and dependency-complete candidate selection under a stated rendering contract. IP-only changes reuse cached memberships. We establish correctness and word-work bounds. On a four-vCPU A10G host, resident GPU execution is 3.46--36.60$\times$ faster than the best tested native CPU path, including CRoaring, and 1.14--2.22$\times$ faster than an adapted operand-parallel GPU reduction. Gains narrow at the host-output boundary: on an eight-vCPU host, including upload and compact identifier output, resolution takes 16.3 ms versus 19.3 ms for CPU at 100K objects and 500 scopes. Sparse labels and small batches can favor CPU execution. Scope reuse, candidate selection, and incremental transfers are measured as components; complete update-to-enforcement latency remains unevaluated.
arXiv cs.SE / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YTesting and AnalysisarXivapproachSoftware testingcs.CLcs.LGcs.SEarXiv cs.SE
Over-Defense in Coding Agents Begins at Silent Forks
Hanjun Luo, Xuecheng Liu, Xiucheng Zhang, Zhuoning Xu, Yingbin Jin, Yankai Chen, Xue Liu, Hanan Salam
2026/10/18 09:56已过 4 天
Language models behind coding agents are post-trained with outcome rewards, and recent methods concentrate credit on the turns that decide the outcome. We find that defensive actions beyond what a task requires escape both. They begin at silent forks, the turns where every next action leads to the same outcome. Such actions leave the success rate unchanged, and frontier models take the disproportionate branch there in up to 91% of decisive actions under implicit budgets. The most direct fix, a checker in the trajectory reward, reaches these forks only through fully proportionate trajectories, leaving 74% of GRPO groups with identical rewards and behavior unchanged. This motivates a rethink of where learning signals belong, namely where behavior diverges, which a behavioral checker can locate and the outcome cannot. Our method, ForkDPO, contrasts a proportionate and a disproportionate action at the same prefix, at silent forks on both sides of the required behavior. On a test set of unseen repositories, it lowers a 4B model's disproportionate behavior from 70.3% to 58.9%, against 67.7% for DPO at randomly chosen turns, establishing behavioral divergence as a learning signal for how agents act beyond whether they finish. The code is publicly available at https://github.com/Astarojth/silent-forks.
arXiv cs.SEAI for Software EngineeringarXivapproachempirical studyAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SE
Theory of Developer Momentum: The Developer's Experience of Progress and the Craft of Maintaining Motion
Arty Starr, Keith Mann, Margaret-Anne Storey
2026/10/18 09:11已过 4 天
This paper introduces a Theory of Developer Momentum that helps us see the activity of developing software in motion and the skilled craft through which progress unfolds. We define Developer Momentum as the developer's experience of progress and forward motion toward the goal of a task. Our theory disentangles the related constructs of flow state, momentum, and motivation, so we can more clearly see the relationships between them and how they interweave to support progress. In order to make progress, developers build up working context in memory, become immersed in a cognitive puzzle, and gain clarity through motion in uncertain terrain. The theory provides researchers with a rich experiential lens to investigate how developers' cognitive experiences are shifting in emerging AI workflows. Building on prior grounded theory work, we conducted in-depth interviews with a theoretically sampled subset of 12 professional developers, and eight feedback interviews to evaluate resonance and investigate how the theory translates to agentic AI workflows. We followed a Constructivist Grounded Theory approach to construct a theory grounded in empirical data. Our theory contributes a novel paradigm for seeing the motion of developing software at multiple scales and resolutions, seeing the living capacities that support this motion, and expanding what becomes available for improvement, skilled judgment, and craft.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachempirical studyConfidentialityintegrityprivacycs.CRcs.AIcs.MAarXiv cs.CR
Same Data, Different Bytes: Serialization-Invariant Integrity Checks for Agent-Published Datasets
Jin Gao, Maura Clark
2026/10/18 07:26已过 4 天
Agent networks require reliable ways for requesting agents to verify where data is located, how it can be accessed, and whether the data received matches what the data owner made available. Checksum mismatches can reflect either altered content or serialization differences that preserve data equivalence under specified rules. Data identification mechanisms for agents, such as DataFacts, describe where data can be accessed and provide checksums for checking received data against published references. We propose a serialization-invariant identification method that assigns the same identifier to data representations equivalent under explicit rules. We use DataFacts as a case study, retaining its existing checksum alongside the proposed identifier. In a controlled agent study, we compare the proposed configuration with ordinary-tool and checksum baselines across equivalent re-encodings, altered content, and unavailable references. The study includes three model tiers from each of two providers. For equivalent re-encodings, the proposed configuration increased expected-outcome rates by 80.4 percentage points over the ordinary-tool baseline and by 70.2 percentage points over the checksum baseline. The proposed configuration also increased evidence-supported rejection of altered content by 3.5 percentage points over the checksum baseline. We contribute a serialization-invariant identification method with explicit equivalence rules, an integration approach illustrated through DataFacts, and an empirical evaluation against ordinary-tool and checksum baselines.
arXiv AI Agents for Software Engineering / arXiv SWE-bench / Defects4J / arXiv AI Coding 3YTesting and AnalysisarXivbenchmarkapproachProgram synthesiscs.LGcs.AIcs.CLarXiv AI Agents for Software Engineering
Arctic-SWE: Revisiting the Long Horizon Agent Training by Modeling-System Co-Design
Boyi Liu, Yite Wang, Xinyu Lian, Fan Shu, Sida Li, Feng Yan, Mingjia Zhang, Yuxiong He, Zhewei Yao
2026/10/18 07:24已过 4 天
Long-horizon agent training, including software engineering, is advancing rapidly, but the recipe and infrastructure needed for a strong reinforcement-learning baseline remain difficult to reproduce. This makes gains from new algorithms or data hard to distinguish from improvements to an under-tuned baseline. We present Arctic-SWE, a fully asynchronous RL framework that establishes such a baseline through model-system co-design, using overfitting on a small task pool as the testbed. This testbed exposes failures that early reward gains conceal and guides the integration of established components: gated reward, importance-weight control, aligned training and inference engines, and consistent state across policy updates. No single component is new, yet together they form the missing foundation. On raw R2E-Gym data, without new algorithms or data work, Arctic-SWE trains Qwen3.5-4B to 62.0% pass@1 on SWE-bench Verified. This is comparable to concurrent FrogNano (61.5%), which relies on online task synthesis, after about one-sixth as many training rollouts. Building on this foundation, we further filter and refine R2E-Gym, SWE-rebench V2, and Scale-SWE. With this curated subset, the 4B model improves from 47.4%/25.0%/37.9% to 65.0%/38.3%/59.7% on SWE-bench Verified/Pro-v1/Pro-v2, and the recipe also improves Qwen3.5-9B from 56.2%/31.9%/48.8% to 65.7%/39.6%/70.2% on Verified/Pro-v1/Pro-v2. Controlled comparisons show that both curation and test strengthening improve held-out performance, although stronger tests reduce apparent training-task mastery. Arctic-SWE provides a documented starting point for studying better algorithms, data and environments for asynchronous agent RL.
arXiv cs.SE / arXiv cs.CR / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.SEarXiv cs.SEarXiv cs.CR
CAT-RAG: Improving Secure Code Generation with Category-Aware Agentic Retrieval
Mahdieh Abazar, Lorenzo De Carli, Benjamin Tan
2026/10/18 07:09已过 4 天
Despite rapid progress in LLM-based code generation, security vulnerabilities remain widespread, and retrieval-augmented code generation (RACG) can further amplify risk when retrieved knowledge is verbose or vulnerable to poisoning. Existing secure RACG approaches inject security knowledge at a fine-grained vulnerability level, causing prompt overhead and diluted model attention when a query implicates multiple related weaknesses. We propose CAT-RAG, an agentic security category-aware retrieval-augmented code generation framework. CAT-RAG performs adaptive category selection via an LLM as a categorizer agent and operates either as a standalone security layer or as a drop-in add-on to RACG pipelines, requiring no modification to the underlying model. We replace CWE-level retrieval with compact, language-specific security categories. These categories provide a higher-level abstraction over individual CWE weaknesses, organizing them by the security concern they share, such as Input Validation and Injection Attacks, rather than merely grouping related entries. Each category consolidates best practices and secure code examples into a single, prompt-efficient representation. We perform a comprehensive evaluation across CyberSecEval, CodeGuard+, and HumanEval. On CyberSecEval, CAT-RAG nearly doubles the secure code generation improvement over the state of the art (23.57% vs. 12.11%) while reducing token overhead by 41.71%.
arXiv cs.SE / arXiv SWE-bench / Defects4J / arXiv AI Coding 3YTesting and AnalysisarXivbenchmarkapproachempirical studySoftware testingcs.SEarXiv cs.SEarXiv SWE-bench / Defects4JarXiv AI Coding 3Y
RXSynth: A Seed-Grounded Corpus for Studying Java Runtime-Exception Bugs
Parnian Eslamloo, Banani Roy
2026/10/18 06:56已过 4 天
Existing Java bug benchmarks offer limited method-level data for studying runtime-exception detection. Filtering Defects4J, Bugs.jar, Bears, and BugSwarm yields only 170 real buggy/fixed method pairs across seven unchecked exception types. We introduce RXSynth, a corpus of 4,275 synthetic Java method pairs generated from real bug/fix exemplars. We select the generator using structural alignment with real seeds and validate pairs using a two-stage patch-anchored procedure that identifies the labelled exception risk and checks whether the repair removes it. Independent JVM execution confirms patch-local validity for 84.2% of a stratified sample of 500 pairs. Provenance records enable evaluation without overlap between generation exemplars and test bugs. Structural analyses show good alignment within the represented size range, but compression of larger methods. We use RXSynth to compare isolated-method detection with pair discrimination when the repair is visible. Under provenance-controlled evaluation, supervised isolated-method ROC-AUC is about 0.55-0.64. Stronger zero-shot models reach about 69% accuracy but identify only 41.2% of repaired methods correctly. In contrast, fine-tuned encoders achieve 70.4-74.8% accuracy with both versions available. However, a simple token-growth rule achieves 84.7% expected accuracy, highlighting repair-direction cues. On 36 pairs without token growth, encoder accuracy falls to approximately chance, while GPT-5.5 and Gemini 3.1 Pro exceed 94%. RXSynth thus supports contrastive, patch-oriented, and context-aware studies; pairwise evaluations should control for provenance and directional surface cues before interpreting high accuracy as defect understanding.
arXiv cs.CR / arXiv AI Coding 3YDependability and SecurityarXivbenchmarkapproachVulnerability detection and software securityConfidentialityintegritycs.CRcs.CLarXiv cs.CRarXiv AI Coding 3Y
Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security
Khushbu Pahwa, Yubin Ge, Daniele Bonadiman, Xiaofei Ma, Yi Zhang
2026/10/18 06:36已过 4 天
LLM code agents increasingly ship code with little oversight, yet defenders trained on static vulnerability datasets fall behind adapting adversaries. We co-train attacker and defender instead, and let execution decide every reward: an attacker (Red) edits a real repository and earns nothing unless its patch applies, builds, passes the tests, completes its development task and reproduces a real exploit in an isolated container, whose path also labels the entry point, the critical operation and the trace between them. Peer-Relative Policy Optimization (PRPO) makes both sides populations of LoRA adapters over one frozen base and credits each against same-role peers that faced an identical condition, placing the population inside the policy-gradient baseline rather than the opponent pool, with a tournament preserving diversity. Matching cancels the condition's difficulty: at equal coverage it is worth 2.3 points of balanced accuracy over a baseline computed on other conditions, and it matches a within-policy control at half the verifier spend. PRPO's 7B diff reviewer reaches 64.8% balanced accuracy on four unseen applications in three untrained languages, 5.5 points above supervised security fine-tuning and 4.4 above a frozen frontier reviewer (Claude Opus 4.8), which it leads by 15.8 on the application it trains on. Its 9B repository agent recovers 23 of 172 held-out VulnGym advisories, against 10 after supervised fine-tuning and 7 for the same backbone untrained under the same scaffold, and locates 17 of 43 reachable entry points against 13 for mini-swe-agent with GLM-5.2. Run unchanged on jailbreak defense, the same algorithm matches or exceeds WildGuard's static F1 at equal corpus and model size. Under a judge distinct from its training oracle it cuts attack success from 36.0% to 4.6%, against WildGuard's 8.9%.
arXiv cs.SETesting and AnalysisarXivapproachempirical studysurveySoftware testingcs.SEarXiv cs.SE
When Does UML Software Modeling Pay Off? A Contingency Model of Industrial Modeling Value
Kleinner Silva Farias de Oliveira
2026/10/18 05:45已过 4 天
With the emergence of specification-driven development (SDD), software modeling has regained strategic importance as a way to translate human intentions, requirements, and design decisions into precise specifications that can guide both developers and AI-assisted development tools. Despite the renewed relevance of modeling in SDD, empirical evidence remains limited on when its benefits outweigh the socio-technical effort required to create, communicate, synchronize, and maintain software models in industrial practice. This study investigates when software modeling generates value in industrial practice. We analyzed 405 survey responses collected from software practitioners. The questionnaire combined closed items concerning UML use, benefits, barriers, and improvement mechanisms with open-ended questions about current use, difficulties, and worthwhile contexts. Most respondents associated modeling with integration discussions (90 percent) and shared understanding (82 percent), but also reported time pressure (85 percent) and the effort required to create and maintain models (80 percent). Selective modeling, model-code synchronization, and collaborative support emerged as conditions that improve its viability, whereas only 24 percent reported daily UML use. Software modeling pays off when its expected contextual value exceeds the socio-technical friction required to create and sustain it. Its value is therefore contingent, not universal.
arXiv cs.CRDependability and SecurityarXivapproachVulnerability detection and software securitycs.AIcs.CLcs.CRcs.MA
The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents
Jinwei Hu, Youcheng Sun, Yi Dong, Xiaowei Huang
2026/10/18 05:21已过 4 天
Can one sentence manipulate an agent's belief by targeting a single implicit warrant linking evidence to a conclusion? In this paper, we introduce the one-relation attack (ORA), a novel cognitive attack on this inferential relation. ORA localizes a critical implicit warrant and performs a one-relation intervention using a single source-grounded sentence that qualifies this warrant and steers the agent toward an incorrect belief. Across eighteen models on biomedical inference and vulnerability detection, best-of-$10 attacks overturn initially correct answers at mean rates of 54.9% for proprietary and 80.0% for open-weight models. Attacks also transfer without victim feedback, and paired controls support the roles of targeting and qualification. Moreover, successful sentences can pass source-support checks and evade identification, and multi-agent debate raises team error from 50.0% to 59.5% in our balanced stress test. These findings establish implicit warrants as a cognitive attack surface for manipulating agents' beliefs.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.CLcs.LGarXiv cs.CR
The Missing Compliance Class: LLM Graders That Collapse Jailbreak Success, and a Free Check
Ruqiya Bin Safi
2026/10/18 05:20已过 4 天
Jailbreak papers report an attack success rate, the share of responses that deliver the harmful request, and read it as a property of the target model. We hold the target model, the prompts and the responses fixed and change only the grader. Three dense graders of 8B and 9B parameters, from three model families, move compliant responses to the neighbouring class, evasion, instead of scattering them across classes. One of them assigns the compliance label zero times in 900 responses. This class collapse also appears on new harmful requests, on a target model from a third family, and in a held-out 7B grader from a fourth family. Per-class label counts expose it at no cost and without human labels. The collapse decides how the rate behaves under a change of grader. On two corpora of 900 responses and eight graders, the compliance rate differs by a factor of 22 to 25, while the non-refusal rate differs by 18 to 23 percentage points. Without the three collapsing graders, compliance differs by a factor of 1.7 to 2.8 on all four corpora, and non-refusal still differs by 10 to 22 points. These results do not change when every grader is called once. We propose a reporting minimum that keeps the compliance rate and adds its per-class label counts and the named grader. Beside it goes the non-refusal rate, whose disagreement across graders is additive.
arXiv cs.SEAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelscs.AIcs.PLcs.SEarXiv cs.SE
Pattern-Driven Evaluation of LLM Code Optimization: Isolating Compiler-Transcendent Semantic Reasoning
Wesley Lu, Runzhou Liu, Hongru Du, Xinyao Yi
2026/10/18 03:33已过 4 天
Existing evaluations of LLM-based code optimization primarily measure end-to-end speedup, obscuring whether a model actually performs the intended optimization. For compiled languages, this is especially problematic: observed gains may reflect transformations already recoverable by modern optimizing compilers rather than optimization behavior attributable to the model itself. We present PatternBench, a benchmark for studying compiler-transcendent optimization, i.e., performance improvements that remain after aggressive compiler optimization. PatternBench targets residual optimization opportunities across seven classes of transformations and pairs runtime evaluation with an AST-based optimization faithfulness analysis that verifies whether the intended optimization is realized in the generated program. Experiments with frontier, open-weight, and fine-tuned models show that runtime speedup alone provides an incomplete account of optimization capability. Optimization faithfulness is strongly associated with realized speedup, and fine-tuning improves both faithfulness and optimization effectiveness. These results suggest that evaluation of LLM-based code optimization should measure not only performance outcomes, but also whether the target transformation was successfully executed.
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CRarXiv cs.CR
Consistency Is the Attack Surface: Detecting Coordinated Retrieval Poisoning with Embedding Geometry
Zeyan Li, Qirong Guo, Jianfeng Xu
2026/10/18 03:29已过 4 天
Consistency-based defenses for retrieval-augmented generation (RAG) rest on an assumption that a sparse adversary breaks: a poisoning campaign may modify a negligible fraction of the corpus, yet retrieval concentrates its passages into the reader's context. Across four Natural Questions retrieval seeds, at least one injection reaches the top-5 in 94.1% of targeted query--seed rows, and all three form a retrieved majority in 52.9%. Under our short-answer protocol, RobustRAG and ReliabilityRAG reach exposure-conditional attack success 0.512, against 0.576 for undefended RAG, while lowering clean accuracy from 0.328 to 0.216. Coordination, however, leaves a fingerprint: a dense, query-anchored component in the evidence embedding geometry. CoordGuard audits this structure from robustly normalized query-weighted affinities, without poison labels, correct answers, or reader gradients. Its always-filter mode suppresses the selected component whenever one forms; a benign-calibrated gate suppresses it only at unusually high scores and traces a robustness--utility frontier. Pooling four retrieval seeds, e5 always-filtering reduces $\mathrm{ASR}_{\mathrm{exp}}$ to 0.167 overall and 0.138 on parametrically unknown queries, at a 13.6-point clean cost, while a Contriever gate retains clean accuracy 0.315 at $\mathrm{ASR}_{\mathrm{exp}}=0.331$. The reduction transfers across two readers, three tasks, and multiple retriever--auditor pairs, and count-matched controls attribute it to component-targeted removal rather than deletion volume. These findings recast poison detection from judging truth to auditing the structure of retrieved evidence.
arXiv cs.SE / arXiv AI Agents for Software Engineering / arXiv AI Coding 3YTesting and AnalysisarXivbenchmarkapproachSoftware testingcs.AIcs.SEarXiv cs.SEarXiv AI Agents for Software Engineering
Teaching Code Agents to Ask Without Leaking Private Code
Wenjia Jiang, Jieke Shi, Zhensu Sun, Chengran Yang, Shidong Pan, Peixin Zhang, Yifan Jia, James Hoang, Xiwei Xu, Zhenchang Xing, David Lo, Zhou Yang
2026/10/18 03:13已过 4 天
Local coding agents can extend their reach by consulting a stronger cloud model. Such consultations, however, often expose the repository's private identifiers, file paths, and source code. Host-side masking hides recognized identifiers but leaves the surrounding code and the agent's phrasing unchanged, while training for less disclosure risks suppressing consultation or producing questions too vague to answer. We propose utility-verified abstraction (UVA), which teaches the agent to describe private entities by their role and type while retaining the technical details an expert needs. From solved repair trajectories, we rewrite each question into this form and keep the rewrite only if it discloses fewer private entities and the repair, replayed from the same execution state with the repair trajectories. Across two benchmarks, the trained agent consults more often than before training. On repository-level issue repair, it solves 37.6% of issues, against 25.3% for the same model working alone, a gain from the training as a whole rather than from consultation alone. Its questions disclose 3.7-fold fewer private entities and 1.4-fold less verbatim code than the untrained agent's questions to the same expert.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.NIarXiv cs.CR
From Trust Scores to Driver Decisions: An Abstaining Evidential Decision Layer for Event Validation in VANETs
İpek Abasıkeleş Turgut
2026/10/18 02:32已过 4 天
Trust management in vehicular ad hoc networks is highly active, yet the decision that a driver needs, whether a reported event is real, has received far less attention; the schemes that make it force every decision into two outcomes, even on thin or conflicting evidence. This paper presents CREST, a vehicle-side event-decision framework that can withhold a decision its evidence does not support. Each vehicle weights the reports it holds by the trust, proximity and freshness of their senders, fuses them with Yager's rule, and decides only when the fused margin reaches an abstention threshold. Abstention is a waiting state: a vehicle still unsure at the event is resolved by an explicit application policy, which makes the trade-off between missed hazards and unnecessary detours visible. CREST requires only a scalar trust per reporter and is built here on an evidential trust model whose consensus and revocation steps are updated to support the decision layer. A single report is shown to change the decision margin by at most its weight, which bounds the influence of an attacker coalition by its trust. In a pre-registered simulation study with fourteen attacks, including position spoofing and trust-gated camouflage, and with all unspecified parameters of all systems tuned by the same procedure, CREST reduces the decision error of two published trust-based dissemination systems from 0.162 and 0.106 to 0.051. With the best-guess policy it also lowers both missed and unnecessary reroutes and outperforms the forced binary rule on both error types in every cell.
arXiv cs.SE / arXiv LLM4Code / Program Repair / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivapproachempirical studyCollaborative AI for SEAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEcs.SEcs.AIarXiv cs.SEarXiv LLM4Code / Program Repair
When LLM-Generated Refactorings Ripple: An Empirical Study of Repository Adoption Readiness
Muhammad Waseem, Aakash Ahmad, Pekka Abrahamsson
2026/10/18 01:29已过 4 天
Large Language Models (LLMs) are increasingly used to refactor source files, but file-local evaluations do not reveal changes to contracts, dependencies, or caller assumptions affecting repository adoption. To address this gap, we conduct 1,500 generation attempts across 150 production files from 15 open-source Java repositories, five LLM configurations, and two dependency-aware generation conditions: single-prompt refactoring and LangGraph-based multi-agent refactoring. Of these attempts, 1,455 yield complete candidates eligible for analysis. We evaluate these candidates using local changes, repository-facing structural indicators, detected caller impact, the behavioural-equivalence indicator, and available test evidence, and categorize them as Low-risk, Review-needed, High Contract/Dependency Risk, or Inconclusive. The results show that 1,365 candidates (93.8%) are classified as High Contract/Dependency Risk, whereas 106 (7.3%) have at least one detected broken downstream caller and 290 (19.9%) have a false behavioural-equivalence indicator; only eight satisfy the Low-risk criteria. Within the reason-covered subset, the High-risk rate decreases under more conservative dependency-delta thresholds, while 60 of the 65 candidates with conclusive targeted-test outcomes pass, including 50 classified as High risk. Paired analyses of 705 complete pairs identify no statistically significant generation-condition difference in the principal risk indicators, although model configurations differ in specific detected risk channels. These findings suggest that practitioners should treat LLM-generated refactorings as candidates requiring staged repository-level verification, while future research should validate screening and extraction precision and strengthen compilation, behavioural, and coordinated multi-file verification.
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.AIarXiv cs.CR
LLM Trojans that Increase Response Lengths and Cost
Zhengxing Li, Guangmingmei Yang, Nader Alfares, David J. Miller, George Kesidis
2026/10/18 01:12已过 4 天
Management of the token-based costs of using LLMs has emerged as a significant problem. Some frontier-model providers charge five times per response token than per prompt token, while others offer prefilling discounts for prompt tokens. In this paper, we devise a defense against a new data-poisoning attack that plants a Trojan which increases the length of the response (and hence the cost to the user) when its trigger is present in the prompt. In particular, we demonstrate how a subtle Trojan may trigger on semantically similar instructions of an instruction fine-tuned LLM.
arXiv cs.CRDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.CRcs.ARarXiv cs.CR
Heart Signal (ECG) as Vibration Signature for Human Authentication Using TinyML
Yogeswar Reddy Thota, Student Member, IEEE, Hanan Alsmadi, Student Member, IEEE, Tooraj Nikoubin, Senior Member, IEEE
2026/10/18 00:06已过 4 天
Ensuring data security in the era of Artificial Intelligence (AI) and deepfake technology requires robust biometric systems. Conventional methods such as facial recognition, iris scans, fingerprints, and voice recognition are increasingly vulnerable to spoofing and provide only one-time authentication at login. This study introduces an Electrocardiogram (ECG) based authentication framework, compared with Photoplethysmography (PPG), leveraging Tiny Machine Learning (TinyML) for deployment on resource-constrained microcontroller units (MCUs). The proposed method enables continuous authentication, offering ongoing verification throughout device usage, which conventional biometrics cannot achieve. It also serves as a password-free solution, reducing risks of credential loss, theft, or reuse. However, ECG signals vary with physical activity, health conditions, age, and emotional states, requiring robust signal processing and learning algorithms. To address this, efficient TinyML models were designed to mitigate recognition errors from noisy real-time data. Experiments used single-lead ECG signals (Lead I) from UofTDB, MIT-BIH Arrhythmia, MIT-BIH Noise Stress Test, and PTB databases. Spectrograms and spectral features were extracted to train Deep Neural Network (DNN), 1D CNN, and 2D CNN models within the Edge Impulse platform, achieving 98% accuracy. The trained model was converted into TinyML format and deployed on an Espressif ESP-EYE (ESP32, 240 MHz). Support Vector Machine (SVM) models were also applied for benchmarking. By analyzing the number of heartbeats required for reliable recognition, the results show that averaging multiple signals improves tolerance to noise and enhances accuracy. Overall, ECG-based authentication demonstrates strong potential as a secure, real-time, and continuously verifiable method for personal identification on wearable and edge devices.