Bridge: High-Order Taint Vulnerabilities Detection in Linux-based IoT Firmware
Jiaqian Peng1,2, Puzhuo Liu3, Yicheng Zeng1,2, Kai Cheng1, Yongji Liu1, Yun Yang1, Hongsong Zhu1,2
1: Institute of Information Engineering, Chinese Academy of Sciences, China, 2: School of Cyber Security, University of Chinese Academy of Sciences, China, 3: Ant Group & Tsinghua University, China
Agentic Concolic Execution
Zhengxiong Luo1, Huan Zhao1, Dylan Wolff1, Cristian Cadar2, Abhik Roychoudhury1
1: National University of Singapore, 2: Imperial College London
"I Wonder if These Warnings Are Accurate": Security and Privacy Advice in Nine Majority World Countries
Collins W. Munyendo1, Veronica A. Rivera2, Jackie Hu3, Emmanuel Tweneboah4, Amna Shahnawaz5, Karen Sowon6, Dilara Keküllüoğlu7, Marcos Silva4, Yue Deng4, Mercy Omeiza8, Gayatri Priyadarsini Kancherla9, Maria Rosario Niniz Silva10, Maryam Mustafa5, Abhishek Bichhawat9, Francisco Marmolejo-Cossio11, Elissa M. Redmiles12, Yixin Zou4
1: The George Washington University, 2: Stanford University, 3: University of Michigan, 4: Max Planck Institute for Security and Privacy, 5: Lahore University of Management Sciences, 6: Indiana University, 7: Sabanci University, 8: University of Ibadan, 9: Indian Institute of Technology Gandhinagar, 10: The College of Michoacán, 11: Boston College, 12: Georgetown University
Practical Multi-party Private Set Intersection with Reducible Zero-sharing
Yewei Guan1, Hua Guo1,2, Man Ho Au3, Jiarong Huo1, Jin Tan4, Zhenyu Guan1
1: Beihang University, 2: The State Key Laboratory of Blockchain and Data Security, Zhejiang University, 3: The Hong Kong Polytechnic University, 4: Independent Researcher
SmuFuzz: Enable Deep System Management Mode Fuzzing in Fully Featured UEFI Runtime Environment
jianqiang wang1, yi xiang2,3, meng wang1, Qinying Wang2,3, Ali Abbasi1, Thorsten Holz4
1: CISPA Helmholtz Center for Information Security, 2: Zhejiang University, 3: EPFL, 4: Max Planck Institute for Security and Privacy
Scalable Accountable Byzantine Agreement and Beyond
Pierre Civit1, Daniel Collins2, Vincent Gramoli3,4, Rachid Guerraoui1, Jovan Komatovic1, Manuel Vidigueira1, Pouriya Zarbafian3
1: EPFL, 2: Texas A&M University, 3: University of Sydney, 4: Redbelly Network
LLM Unlearning Should Be Form-Independent
Xiaotian Ye1,2, Mengqi Zhang3, Shu Wu1
1: Institute of Automation, Chinese Academy of Sciences, 2: Beijing University of Posts and Telecommunications, 3: Shandong University
Breaking the Illusion: Automated Reasoning of GDPR Consent Violations
Ying Li1, Wenjun Qiu2, Faysal Hossain Shezan3, Kunlin Cai1, Michelangelo van Dam4, Lisa Austin2, David Lie2, Yuan Tian1
1: University of California, Los Angeles, 2: University of Toronto, 3: University of Texas at Arlington, 4: in2it
Ensemble Conformal Predictor (EnCP): A New Conformal Predictor with Robustness Guarantees against Data Poisoning Attacks
Yuxin Yang1,2, Qiang Li1, Runyang Feng3, Liren Shan4, Binghui Wang2
1: College of Computer Science and Technology, Jilin University, 2: Department of Computer Science, Illinois Institute of Technology, 3: School of Artificial Intelligence, Jilin University, 4: Toyota Technological Institute at Chicago
PromoGuardian: Detecting Promotion Abuse Fraud with Multi-Relation Fused Graph Neural Networks
Shaofei Li1, Xiao Han2, Ziqi Zhang3, Zhenkai Liang4, Yao Guo1, Xiangqun Chen1, Ding Li1, Shuli Gao5, Minyao Hua5
1: Key Laboratory of High-Confidence Software Technologies (MOE), School of Computer Science, Peking University, 2: School of Electronics Engineering and Computer Science, Peking University, 3: University of Illinois Urbana-Champaign, 4: National University of Singapore, 5: Meituan
Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and YouTube
Sai Keerthana Karnam1, Abhisek Dash2, Antariksh Das1, Sepehr Mousavi2, Stefan Bechtold3, Krishna Gummadi2, Animesh Mukherjee1, Ingmar Weber4, Savvas Zannettou5
1: Indian Institute of Technology, Kharagpur, 2: Max Planck Institute for Software Systems, 3: ETH Zürich, 4: Saarland University, 5: Delft University of Technology
Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation
Baolei Zhang1, Haoran Xin1, Yuxi Chen2, Zhuqing Liu3, Biao Yi1, Tong Li1, Lihai Nie1, Zheli Liu1, Minghong Fang4
1: Nankai University, 2: Guilin Institute of Information Technology, 3: University of North Texas, 4: University of Louisville
GraphRAG under Fire
Jiacheng Liang1, Yuhui Wang1, Changjiang Li1, Rongyi Zhu1, Tanqiu Jiang1, Neil Gong2, Ting Wang1
1: Stony Brook University, 2: Duke University
Breaking the Barrier for Asynchronous MPC with a Friend
Banashri Karmakar1, Aniket Kate2, Shravani Patil1, Arpita Patra1, Sikhar Patranabis3, Protik Paul4, Divya Ravi5
1: IISc Bangalore, 2: Supra Research / Purdue University, 3: IBM Research India, 4: TU Darmstadt, 5: University of Amsterdam
Dory: Streaming PCG with Small Memory
Xiaojie Guo1,2, Hanlin Liu3, Zhicong Huang4, Hongrui Cui5, Wenhao Zhang3, Cheng Hong4, Xiao Wang3, Kang Yang2, Yu Yu1,5
1: Shanghai Qi Zhi Institute, 2: State Key Laboratory of Cryptology, 3: Northwestern University, 4: Ant Group, 5: Shanghai Jiao Tong University
Practical Anonymous Two-Party Gradient Boosting Decision Tree
Chenyu Huang1, Fan Zhang1, Minxin Du2, Sherman S. M. Chow3, Huangxun Chen4, Huaming Rao1, Danqing Huang1, Bo Qian1, Peng Chen1
1: Tencent, 2: The Hong Kong Polytechnic University, 3: The Chinese University of Hong Kong, 4: Hong Kong University of Science and Technology (Guangzhou)
International Students and Scams: At Risk Abroad
Katherine Zhang1, Arjun Arunasalam2, Pubali Datta3, Z. Berkay Celik4
1: University of Massachusetts Amherst, 2: Florida International University, 3: University of Massachuetts Amherst, 4: Purdue University
SoK: Robustness in Large Language Models against Jailbreak Attacks
Feiyue Xu1, Hongsheng Hu1, Chaoxiang He1, Sheng Hang1, Hanqing Hu1, Xiuming Liu1, Yubo Zhao1, Zhengyan Zhou1, Bin Benjamin Zhu2, Shi-Feng Sun1, Dawu Gu1, Shuo Wang1
1: Shanghai Jiao Tong University, 2: Microsoft
DREAM: Scalable Red Teaming for Text-to-Image Generative Systems via Distribution Modeling
Boheng Li1, Junjie Wang2, Yiming Li1, Zhiyang Hu2, Leyi Qi3, Jianshuo Dong4, Run Wang2, Han Qiu4, Zhan Qin3, Tianwei Zhang1
1: Nanyang Technological University, 2: Wuhan University, 3: Zhejiang University, 4: Tsinghua University
Evaluating Concept Filtering Defenses against Child Sexual Abuse Material Generation by Text-to-Image Models
Ana-Maria Cretu1, Klim Kireev1,2, Amro Abdalla3, Wisdom Obinna3, Raphael Meier4, Sarah Adel Bargal3, Elissa M. Redmiles3, Carmela Troncoso1,2
1: EPFL, 2: MPI-SP, 3: Georgetown University, 4: armasuisse S+T
Private Data Imputation
Abdelkarim Kati1, Florian Kerschbaum1, Marina Blanton2
1: University of Waterloo, 2: University at Buffalo
Can I Get More? An Incremental Inference Attack on Encrypted SQL
Xiaoqian Sun1, Ruiqi He2, Yang Zhang1, Siyi Lv2, Guiyun Qin2, Fangzhou Yi2, Zheli Liu1, Xiaofeng Chen3
1: Nankai University, 2: CS, DISSec, Nankai University, China, 3: Xidian University
Jazzer: Coverage-Guided Fuzzing for Semantic Vulnerabilities in the Java Ecosystem
Sergej Dechand1,2, Tobias Wienand3, Fabian Meumertzheim2, Peter Samarin2, Simon Resch2, Khaled Yakdan2, Thorsten Holz1, Flavio Toffalini3
1: Max Planck Institute for Security and Privacy, 2: Code Intelligence, 3: Ruhr University Bochum
PromptCOS: Towards Content-only System Prompt Copyright Auditing for LLMs
Yuchen Yang1, Yiming Li2, Hongwei Yao3, Enhao Huang1, Shuo Shao1, Yuyi Wang4, Zhibo Wang1, Dacheng Tao2, Zhan Qin1
1: Zhejiang University, 2: Nanyang Technological University, 3: City University of Hong Kong, 4: CRRC Zhuzhou Institute & Tengen Intelligence Institude
Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
Shuli Zhao1, Qinsheng Hou1, Zihan Zhan1, Yanhao Wang2, Yuchong Xie3, Yu Guo1, Libo Chen1, Shenghong Li1, Zhi Xue1
1: Shanghai Jiao Tong University, 2: Independent Researcher, 3: Hong Kong University of Science and Technology
PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities
Shangzhi Xu1, Ziqi Ding2, Xiao Cheng3, Yuekang Li2, Nan Sun2, Benjamin Turnbull2, Shuangxiang Kan2, Siqi Ma4
1: The University of New South Wales & CSIRO, 2: The University of New South Wales, 3: Macquarie University, 4: The University of Wollongong
TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World Workloads
Tristan Hornetz1, Hosein Yavarzadeh2, Albert Cheu3, Adria Gascon3, Lukas Gerlach1, Daniel Moghimi3, Phillipp Schoppmann3, Michael Schwarz1, Ruiyi Zhang1
1: CISPA Helmholtz Center for Information Security, 2: UC San Diego, 3: Google
Weighted Batched Threshold Encryption with Applications to Mempool Privacy
Amit Agarwal1, Kushal Babel1, Sourav Das1, Babak Poorebrahim Gilkalaye1, Arup Mondal2, Benny Pinkas3, Peter Rindal1, Aayush Yadav4
1: Category Labs, 2: Ashoka University, 3: Bar-Ilan University, 4: George Mason University
Toward Concise and High-fidelity Rust Decompilation
Yibo Liu1, Zion Leonahenahe Basque1, Arvind S Raj1, Chavin Udomwongsa1, Chang Zhu1, Jie Hu1, Changyu Zhao2, Fangzhou Dong1, Adam Doupé1, Tiffany Bao1, Yan Shoshitaishvili1, Ruoyu Wang1
1: Arizona State University, 2: Stanford University
Responsible Disclosure is a Two-Way Street: Empirically Measuring the Responsible Disclosure Contract in the Firmware Ecosystem
Hui Jun Tay, Souradip Nath, Arvind S Raj, Abhay Bhat, Ishan Bansal, Audrey Dutcher, Moritz Schloegel, Adam Doupé, Tiffany Bao, Yan Shoshitaishvili, Ruoyu Wang
Arizona State University
ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery
Zirui Gong1, Leo Yu Zhang1, Yanjun Zhang2, Viet Vo3, Tianqing Zhu4, Shirui Pan1, Cong Wang5
1: Griffith University, 2: University of Technology Sydney, 3: Swinburne University of Technology, 4: City University of Macau, 5: City University of Hong Kong
GoSSamer: Lightweight and Linear-Communication Asynchronous (Dynamic Proactive) Secret Sharing and the Applications
Xinxin Xing1, Yizhong Liu1, Boyang Liao1, Jianwei Liu1, Bin Hu1, Xun Lin2, Yuan Lu3, Tianwei Zhang4
1: Beihang University, 2: The Chinese university of Hong Kong, 3: A*STAR Institute for Infocomm Research, 4: Nanyang Technological University
LLMThief: Evaluating Configuration Leaking Risks in Commercial LLM App Stores
Pinji Chen1, Jinlong Jiang2, Jianjun Chen1, Feiran Qin1, Minghao Zhang1, Jiahe Zhang1, Haixin Duan1, Kaiwen Shen1,3, Hui Jiang1,4
1: Tsinghua University, 2: Wuhan University, 3: Clouditera Inc, 4: Baidu Inc
INSIGHT: Automatic Generation of Explanations for Efficient Identification of Hardware Bugs and Underspecifications
Vincent Quentin Ulitzsch1, Alessandro Bertani1,2, Peter William Deutsch1, David Langus Rodriguez3,4, Kelly Xu1, Aarti Gupta5, Sharad Malik5, Mengjia Yan1
1: Massachusetts Institute of Technology, 2: Politecnico di Milano, 3: MIT Lincoln Laboratory, 4: Cornell University, 5: Princeton University
Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach
Guilin Deng1, Silong Chen1, Yuchuan Luo1, Yi Liu2, Songlei Wang3, Zhiping Cai1, Lin Liu1, Xiaohua Jia2, Shaojing Fu1
1: National University of Defense Technology, 2: City University of Hong Kong, 3: Shenzhen University
Secure Lookup Tables: Faster, Leaner, and More General
Chongrong Li1, Pengfei Zhu2, Yun Li3, Zhanpeng Guo3, Jingyu Li3, Yuncong Hu1, Zhicong Huang3, Cheng Hong3
1: Shanghai Jiao Tong University, 2: Tsinghua University, 3: Ant Group
The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software
Oliver Jacobsen1,2, Tobias Kirsch1,2, Haya Schulmann1,2, Niklas Vogel1,2, Michael Waidner1,3,4
1: National Research Center for Applied Cybersecurity ATHENE, 2: Goethe-Universität Frankfurt, 3: Fraunhofer Institute for Secure Information Technology SIT, 4: Technische Universität Darmstadt
GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit
Junpeng Wan1,2, Yanan Guo3, Zhi Zhang4, Zhuo Li5, Dave (Jing) Tian1, Zhenkai Zhang2
1: Purdue University, 2: Clemson University, 3: University of Rochester, 4: University of Western Australia, 5: HydroX AI
Sparse Estimation Under Local Differential Privacy at All Privacy Levels
Puning Zhao1, Qingqing Ye2, Shaowei Wang3, Jun Feng4, Sheng Yue1, Zhen Chen5, Xiaochun Cao1
1: Sun Yat-sen University, 2: Hong Kong Polytechnic University, 3: Guangzhou University, 4: Huazhong University of Science and Technology, 5: Jinan University
NetPanic: The Attack Surface You Can’t Syscall
Tianshuo Han1, Zong Cao2, Zhen Dong3, Xiapu Luo4, Zhenyu Song1, Jian Liu1
1: Institute of Information Engineering, Chinese Academy of Sciences, 2: Imperial Global Singapore, 3: Fudan University, 4: The Hong Kong Polytechnic University
Robot: Robust Threshold BBS+ in Two Rounds
Guofeng Tang1, Tian Qiu2, Bowen Jiang1, Haiyang Xue1, Guomin Yang1, Man Ho Au3, Robert H. Deng1, Kwok-Yan Lam4
1: Singapore Management University, 2: Digital Trust Centre, Nanyang Technological University, 3: The Hong Kong Polytechnic University, 4: College of Computing and Data Science and Digital Trust Centre, Nanyang Technological University
XXXXXX
Philipp Giersfeld, Benedict Schlüter, Shweta Shinde
ETH Zurich