This work compares model capacity and structured context for generating SIEM detection rules. It contrasts no context, retrieval-augmented context, knowledge-graph context and their combination across open-weight models. The evaluation separates structural properties of generated rules from their effectiveness in detecting attacks.
The available submission used cloud inference infrastructure. Equivalence with local quantized deployment was assumed and had not yet been validated in that version. The camera-ready revision is in preparation, so numerical claims should be taken from the eventual final manuscript.
The organizers offered proceedings publication with a poster on 15 September 2026. Final publication remains subject to author registration and the conference’s camera-ready requirements. This record does not claim a regular oral presentation, a completed proceedings deposit or an assigned DOI. The page date is the date this record was added.
]]>Conference period: 2026-11. The page date records this listing; it is not a proceedings publication date.
Organizations run purple team exercises, find gaps, patch a few rules, and report success—but without a formal measurement framework, they cannot quantify how much detection improved or why specific techniques went undetected. Attack prediction models achieve strong F1 scores but produce no defensive output, while CTI knowledge graphs map threats to countermeasures without testing them on real telemetry. The gap between emulating an attack and proving that detection improved remains open. We close this gap with a knowledge-graph-driven framework for instrumented purple teaming. A bidirectional knowledge graph encodes the full chain from ATT&CK technique to data source, detection strategy, analytic rule, log source, and sensor—not just the attack side. Each emulation step is annotated with expected telemetry and success criteria, so that when detection fails, backward traversal of the graph pinpoints why: a missing log source, an absent rule, or an inadequate configuration. After targeted remediation, the same scenario is replayed and improvement is quantified through operational KPIs anchored by detection coverage (𝐶). We evaluate on four threat profiles—nation-state espionage (APT29), financial cybercrime (FIN6), state destructive operations (Sandworm), and big-game-hunting ransomware (Wizard Spider)—all sourced from the public CTID adversary emulation library [1]. The primary endpoint is detection coverage (𝐶), evaluated with a fixed-threshold decision rule (Δ𝐶 > 0.10 in ≥3/4 scenarios). The four-step detection maturity ladder raises strict coverage from 𝐶0 = 23.1% (out-of-the-box SIEM) to 𝐶3 = 71.6% (with KGPT (Knowledge-Graph Purple Teaming)-guided rules), with the KG-guided rule engineering step alone contributing Δ𝐶3 = +30.3 percentage points on average. The decision rule is satisfied in all four scenarios.
Author manuscript, 16 pages, archived on 13 May 2026. The PDF contains the authors’ CC BY 4.0 notice and is shared unchanged. The final proceedings version is not yet verified. Section 10 describes an artifact repository kept private during review; no public implementation is linked here.
]]>Conference period: 2026-12. The page date records this listing; it is not a proceedings publication date.
Autonomous Web agents can agree on a task while enforcing incompatible cryptographic, fallback, resumption, and lease policies. This paper presents PQTrust-Agent, a constraint-first bilateral authorization protocol. Each endpoint compiles private capability and hard-policy constraints into a local safe set; commit–reveal locks the disclosed negotiation inputs; and selection is restricted to the common measured-cost Pareto frontier. The outcome is an RFC-8785-canonical task contract signed by both endpoints with ML-DSA and enforced before real TLS 1.3 and task execution; endpoint TLS authentication remains classical X.509. Infeasibility yields a verifiable subset-minimal conflict certificate and a fail-closed abort, with no weaker retry. In a pre-specified 1,040-observation single-machine campaign, all 480 feasible sessions completed, all 150 infeasible sessions aborted before TLS and task execution, and all 200 author-designed conformance and robustness mutations were rejected with their expected outcomes. Median end-to-end latency was 432.7–537.6 ms; minimax itself took 5.25 ms, with no statistically detected runtime or resource difference from three safe baselines. Three of the four feasible scenarios had singleton frontiers. On the only non-singleton evaluated P0/P3 frontier, minimax coincided with canonical-first-safe and minimum-total-cost in all 1,210 preference conflicts; relative to either endpoint’s unilateral minimum-cost selector, it reduced maximum regret in 605 conflicts and tied in 605. Distinct minimax decisions relative to those two safe heuristics appeared only in an explicitly post-hoc constructed 15-profile frontier, while no profitable unilateral misreport was observed on the tested finite grid. These results support an auditable task-scoped fail-closed mechanism, not complete post-quantum endpoint authentication or Internet-scale performance.
The PDF is an author manuscript, with an IEEE copyright and version notice. The version of record will be linked when its DOI is available.
]]>Conference period: 2026-09. The page date records this listing; it is not a proceedings publication date.
The study uses a knowledge graph to supply valid fields, log sources and Sigma categories to a language model that generates detection rules. It evaluates structural dimensions separately: syntax and compilation, fields, log source, ATT&CK tags and agreement with reference rules.
The revised presentation distinguishes cloud-hosted inference from the possibility of a future self-hosted deployment. It also distinguishes structural agreement from operational detection effectiveness. The reference rules share provenance with the graph and the evaluation scenarios, so agreement with those rules does not provide an independent test of generalization.
This English summary is based on the authors’ revised LLM4Sec presentation dated 14 September 2026, prepared for ESORICS on 18 September. A permanent public URL for the presentation and the artifact has not yet been verified. It should be read alongside the final proceedings version when available.
Related methodology: Benchmarking Detection Engineering Improvements through Instrumented Adversary Emulation.
]]>Conference period: 2026-11. The page date records this listing; it is not a proceedings publication date.
This early extended abstract presents a Kabyle spell checker combining edit distance, phonetic matching, n-gram context models and linguistic rules for the state of annexation. It describes community participation and an evaluation using synthetic spelling noise. Evaluation on real errors from OCR and automatic speech recognition is identified as ongoing work; LLM integration is future work in this version.
Early author extended abstract, 3 pages, archived on 18 August 2026. This is the available initial version, not a verified final conference manuscript. The title is retained exactly as in the manuscript and HAL record. The PDF is shared unchanged, including its limitations and AI-use statement. A subsequent conference revision has not been verified.
]]>Conference period: 2026-09. The page date records this listing; it is not a proceedings publication date.
GovSecLLM++ connects security testing of LLM applications to inspectable governance evidence. Its public artifact package includes adaptive test outputs, scoring utilities, strict rescoring files, human-validation summaries, a data card and reproducibility notes. The examples use synthetic secrets and credentials.
The software and dataset are separately citable objects. Software DOI · Dataset concept DOI · Dataset version DOI. The current code release does not include the final paper PDF.
]]>Conference period: 2026-09. The page date records this listing; it is not a proceedings publication date.
This study distinguishes an alert that fires from an alert that correctly identifies the emulated ATT&CK technique. Its four outcomes are det (correct detection), det* (an alert with an incorrect technique mapping), tel (telemetry without an alert) and none (missing telemetry). The mapping-quality gap is the difference between effective coverage and strict coverage.
The revised presentation describes four scenarios and 80 laboratory runs. Adding 2,396 community rules increases effective coverage by 33.1 percentage points while adding no strict detections in those scenarios. Knowledge-graph diagnosis then guides targeted rule authoring. These targeted rules were evaluated on the same scenarios that informed their design; validation on held-out scenarios remains future work.
This English summary is based on the authors’ revised ANUBIS presentation dated 14 September 2026, prepared for ESORICS on 18 September. A permanent public URL for the presentation and the artifact has not yet been verified. The presentation is a separate object from the final proceedings paper.
Related study: Knowledge-Graph-Constrained LLM Generation of SIEM Detection Rules.
]]>Conference period: 2026-11. The page date records this listing; it is not a proceedings publication date.
The archived source snapshot includes the original Python implementation, configuration, synthetic fixture, tests and results. On 18 September 2026, 33 of the 34 existing tests passed. One paper-macro export consistency check failed. See the validation report before reusing the archived numerical results. The accompanying manuscript is not included in this snapshot.
]]>Conference period: 2026-10. The page date records this listing; it is not a proceedings publication date.
Tool-augmented LLM agents produce structured, multi-phase network traffic whose encrypted metadata—packet sizes, inter-arrival times, burst boundaries, and streaming cadence—can reveal which tools were invoked, whether retrieval or memory was used, and coarse properties of the underlying task. We study this leakage in a scoped single-endpoint deployment model and introduce AgentFlowShield, a phase-aware egress shaping layer combining bucket padding, frame aggregation, bounded jitter, tool normalisation, memory envelopes, and a risk-aware controller. On a 6,300-trace controlled testbed we evaluate six inference attacks under no-defence, generic, and phase-aware defences, probe generalisation with a template-disjoint split, and evaluate three defence-aware adversaries. We provide a bounded within-phase size-channel analysis, identify residual leakage channels, and demonstrate the defence architecture in a controlled loopback testbed with synthetic WAN noise. AgentFlowShield-full preserves low engineering overhead (24 % measured latency overhead in the final utility run) but does not eliminate leakage against the strongest standard-split adversaries (97-100% residual AUPRC on A1-A4). Its clearest gains appear in the template-disjoint and policy-aware settings: D9 shows mixed results in unseen-template splits, with workflow-type AUPRC increasing from 0.385 to 0.453 (indicating higher detectability) and tool-type decreasing from 0.512 to 0.490, while policy-aware A1 fusion drops from 0.995 under random padding to 0.442 under D9. The final results therefore show a narrower but more defensible claim: phase-aware shaping helps generalisation-resistant and calibrated attacks, but fixed-envelope defences still leave strong residual standard-split signals.
The PDF is an author manuscript, with an IEEE copyright and version notice. The version of record will be linked when its DOI is available.
Download the authors’ AgentFlowShield presentation (PowerPoint, 12 slides).
This is the supplied presentation associated with AICCSA 2026. For exact evaluation conditions, residual leakage and the scope of the results, consult the author manuscript above.
]]>Version: v3.0.1. Published: 28 August 2026. Software license: MIT, as stated in the Zenodo record.
The archive describes a synthetic benchmark for indirect prompt injection during error recovery in tool-using agents. Its design combines typed error terminals, a planner that only proposes actions, and a monitor controlling the authority to produce individual effects. It includes per-episode records across seven models, an automated policy-aware attacker, and a comparison between value-based and provenance-based policies. The benchmark uses synthetic canaries; the archive does not report attacks against real systems.
The archive provides the software, recorded results and an offline make reproduce workflow. Download errorcaps-repro-v3.0.1.zip from the official archive for the instructions and recorded results.
Where Does Recovery-Path Injection Security Come From? Decomposing Error Sanitization, Effect Monitoring, and Policy Precision
The archive carries a CRiSIS 2026 label. This label does not establish acceptance or proceedings publication of the associated manuscript. The DOI on this page identifies the software archive, not a journal or proceedings paper.
Yulliwas Ameur; Samia Bouzefrane; Soumya Banerjee. ErrorCaps: committed-effect measurement of recovery-path injection defense (CRiSIS 2026 artifact). Version v3.0.1. Zenodo, 2026. Version DOI.
The concept DOI groups versions of the archive. Cite the version DOI above when using this specific release. Download the site bibliography in BibTeX.
]]>Version: v1.1. Published: 28 August 2026. Software license: MIT, as stated in the Zenodo record.
The archive compares four enforcement configurations: bearer JWTs, certificate-bound tokens using RFC 8705, an attestation-gated bound-token control, and SPIFFE X.509 SVIDs. The described architecture combines an NGINX-style policy enforcement point with Open Policy Agent.
The package includes a measurement harness, bootstrap and TOST analysis, ablations and second-host experiments, a ProVerif 2.05 model suite with replay, forwarding and self-assertion controls, and SPIRE 1.9.6 validation material. Download LNET_V3_artifact.zip from the official archive for the reproduction instructions and recorded results.
Bearer, Bound, Attested: Factoring Key Binding, Provenance, and Attestation for Zero-Trust Enforcement
The archive describes the associated manuscript as a submission to IEEE Networking Letters. Acceptance and publication of the manuscript are not established by this software release. The DOI on this page identifies the software archive, not a journal or proceedings paper.
Yulliwas Ameur; Soumya Banerjee; Samia Bouzefrane. Bearer, Bound, Attested: Factoring Key Binding, Provenance, and Attestation for Zero-Trust Enforcement (reproducible artefact). Version v1.1. Zenodo, 2026. Version DOI.
The concept DOI groups versions of the archive. Cite the version DOI above when using this specific release. Download the site bibliography in BibTeX.
]]>This artifact package accompanies the SECAI 2026 submission: GovSecLLM++: A Compliance-Aware Benchmark for Security Testing and Governance Evidence in LLM-Based Applications GovSecLLM++ is a compliance-aware benchmark and evaluation protocol for security testing of LLM-based applications. The benchmark maps governance requirements to application-level risks, adversarial scenario cards, expected safe behaviours, measurable security and governance metrics, and audit evidence. This package contains the experimental artifacts without the final paper source/PDF. It includes: - AdaptiveGovSec-120 outputs and summaries; - corrected F2 hidden-context confidentiality rerun outputs; - mini multi-model benchmark outputs; - strict rescoring files; - human-validation summary workbook; - scoring utilities; - reproducibility notes; - data card; - checksums and package manifest. The main experimental components are: 1. Controlled validation with 6300 runs. 2. Hosted Groq full-suite evaluation with 1050 real-backend runs. 3. Multi-model mini-benchmark and strict rescoring. 4. Corrected F2 rerun to separate hidden-context leakage from user-provided canary echoing. 5. AdaptiveGovSec-120 with 478 successful calls out of 480 expected calls. 6. Human-confirmed validation on a stratified sample of 50 outputs. All secrets, policy records, documents, tools, and credentials are synthetic. The artifact does not contain real personal data, real credentials, or real confidential organizational data. The benchmark provides technical and governance-oriented evaluation evidence. It does not constitute legal certification of compliance with the EU AI Act, ISO/IEC 42001, or any other regulatory framework.
]]>Machine Learning as a Service (MLaaS) enables users to outsource compute-intensive analytics, but processing sensitive data in clear on a cloud server raises strong privacy concerns. Fully Homomorphic Encryption (FHE) enables computations over encrypted data, yet implementing k-means under FHE is challenging because the assignment step requires repeated comparisons (argmin), while centroid updates involve divisions. We propose a TFHE-based privacy-preserving k-means protocol that performs the entire assignment step homomorphically. For each iteration, the cloud evaluates encrypted comparisons of squared Euclidean distance differences using TFHE programmable bootstrapping, and returns encrypted one-hot assignment vectors. The client decrypts only these assignment vectors once per iteration to update centroids in clear and sends the refreshed centroids back. This design eliminates any server-side decryption and avoids trusted third parties while keeping client work lightweight. We evaluate on several real datasets using ARI/NMI (when labels exist) and internal metrics (inertia/silhouette). The encrypted clustering closely matches plaintext Forgy k-means for moderate numbers of clusters, while runtime is dominated by bootstrapping operations and thus benefits from parallelization.
]]>Machine Learning (ML) classifiers are pivotal in various applied ML domains. The accuracy of these classifiers requires meticulous training, making the exposure of training datasets a critical concern, especially concerning privacy. This study identifies a significant trade-off between accuracy, computational efficiency, and security of the classifiers. Integrating classical Homomorphic Encryption (HE) and Differential Privacy (DP) highlights the challenges in parameter tuning inherent to such hybrid methodologies. These challenges concern the analytical components of the HE algorithm’s privacy budget and simultaneously affect the sensitivity to noise in the subjected ML hybrid classifiers. This paper explores these areas and proposes a hybrid model using a basic client-server architecture to combine HE and DP algorithms. It then examines the sensitivity analysis of the aforementioned trade-off features. Additionally, the paper outlines initial observations after deploying the proposed algorithm, contributing to the ongoing discourse on optimizing the balance between accuracy, computational efficiency, and security in ML classifiers.
]]>This paper presents a novel framework for enhancing privacy in Vehicular Ad Hoc Networks (VANETs) by integrating homomorphic encryption with machine learning applications. VANETs, essential for Intelligent Transport Systems (ITS), face significant challenges in privacy and security due to their highly dynamic and heterogeneous nature. Our framework addresses these challenges by employing a simplified but effective machine learning algorithm, the K-nearest neighbors (KNN), to ensure the security and privacy of the network. The flexibility of the framework allows for the incorporation of other machine learning algorithms, enhancing its adaptability and efficiency in various VANET scenarios. Key to this framework is the use of homomorphic encryption (HE), a cryptographic technique that enables computations on encrypted data without the need for decryption. This feature preserves data confidentiality and allows for secure third-party computations. Our paper discusses the evolution and types of homomorphic encryption, emphasizing the importance of Fully Homomorphic Encryption (FHE) for its ability to evaluate complex polynomial functions. The paper also highlights the different domains of cybersecurity concerns in VANETs, including in-vehicle systems, ad-hoc and infrastructure networks, and data analysis. The proposed framework aims to mitigate these vulnerabilities, particularly focusing on preventing common attacks like DoS and location tracking. A significant advantage of our approach is its general nature, making it applicable to various privacy issues in VANETs. We propose the potential integration of homomorphic encryption with other privacy-preserving techniques, such as differential privacy or secure multi-party computation, to enhance computation times while ensuring robust privacy protection.
Machine Learning as a Service (MLaaS) has accelerated the adoption of machine learning techniques in various fields. However, this trend has also raised serious concerns about the security and privacy of the sensitive data used in machine learning models. To address this challenge, we use homomorphic encryption. The aim of this thesis is to investigate the implementation of homomorphic encryption in different machine learning applications. The first part of the thesis focuses on the use of homomorphic encryption in a multi-cloud environment, where the encryption is applied to simple operations such as addition and multiplication. This thesis investigates the application of homomorphic encryption to the k-nearest neighbors (k-NN) algorithm. The study presents a practical implementation of the k-NN algorithm using homomorphic encryption and demonstrates the feasibility of this approach on a variety of datasets. The results show that the performance of the k-NN algorithm with homomorphic encryption is comparable to that of the unencrypted algorithm. Third, the paper investigates the application of homomorphic encryption to k-means clustering algorithm. Similar to the k-NN study, this paper presents a practical implementation of the k-means algorithm using homomorphic encryption and evaluates its performance using different datasets. Finally, the thesis explores the combination of homomorphic encryption with Differential Privacy (DP) techniques to further improve the confidentiality of machine learning models. The study proposes a novel approach that combines homomorphic encryption with DP to achieve better privacy guarantees for machine learning models. The research results presented in this paper contribute to the growing body of research at the intersection of homomorphic encryption and machine learning and provide practical implementations and evaluations of homomorphic encryption in various machine learning contexts.
Original English abstract from the archived thesis (p. 22). Institutional thesis record and available version on HAL.
Exploration de l’apprentissage automatique avec le chiffrement homomorphe dans l’internet des objets/Cloud L’apprentissage automatique en tant que service (MLaaS) a accéléré l’adoption des techniques d’apprentissage automatique dans divers domaines. Toutefois, cette tendance a également soulevé de sérieuses inquiétudes quant à la sécurité et à la confidentialité des données sensibles utilisées dans les modèles d’apprentissage automatique. Pour relever ce défi, notre approche consiste à utiliser le chiffrement homomorphique.Cette thèse explore l’application du chiffrement homomorphe dans divers contextes d’apprentissage automatique. La première partie du travail se concentre sur l’utilisation du chiffrement homomorphe dans un environnement multi-cloud, où le chiffrement est appliqué à des opérations simples telles que l’addition et la multiplication.Cette thèse explore l’application du chiffrement homomorphique à l’algorithme k-nearest neighbors (k-NN). L’étude présente une implémentation pratique de l’algorithme k-NN utilisant le cryptage homomorphique et démontre la faisabilité de cette approche sur une variété d’ensembles de données. Les résultats montrent que les performances de l’algorithme k-NN utilisant le cryptage homomorphique sont comparables à celles de l’algorithme non chiffré.Troisièmement, les travaux étudient l’application du chiffrement homomorphique à l’algorithme de regroupement k-means. Comme pour l’étude k-NN, la thèse présente une implémentation pratique de l’algorithme k-means utilisant le chiffrement homomorphique et évalue ses performances sur différents ensembles de données.Enfin, la thèse explore la combinaison du chiffrement homomorphique avec des techniques de confidentialité différentielle (DP) pour améliorer encore la confidentialité des modèles d’apprentissage automatique. L’étude propose une nouvelle approche qui combine le chiffrement homomorphique avec la protection différentielle afin d’obtenir de meilleures garanties de confidentialité pour les modèles d’apprentissage automatique. La recherche présentée dans cette thèse contribue au corpus croissant de recherche sur l’intersection du chiffrement homomorphique et de l’apprentissage automatique, en fournissant des implémentations pratiques et des évaluations du chiffrement homomorphique dans divers contextes d’apprentissage automatique.
]]>Taking advantage of the high performance and powerful data processing capabilities of cloud computing technology, externalizing data to the cloud platform is considered as an inevitable trend in the digital field today. However, ensuring the security and privacy of data remains a major challenge. To overcome this drawback, a multi-cloud platform is proposed to improve privacy and high availability of data. A multi-cloud platform that integrates public, private, and managed clouds with a single user interface. Cloud-hosted data is distributed among different data centers in a multi-cloud environment based on cloud reliability and data sensitivity. In terms of security, current encryption algorithms are considered to be very efficient, but it requires a lot of resources to handle this, which is expensive and time consuming. In addition, they also make the data impossible to process without first decoding. To be specific, traditional public key encryption requires data to be decrypted before it can be analyzed or manipulated. In contrast, homomorphic encryption is an encryption method that allows data to be encrypted while it is being processed and manipulated. It allows user or a third party, which can be cloud provider, to apply functions on encrypted data without revealing the data’s values. In this paper, we explore existing multi-cloud-based security solutions using homomorphic encryption to identify open issues and opportunities for further enhancement.
]]>Privacy-Enhancing Technologies (PETs) have been developed to securely process and confidently share sensitive data. The two main categories of PETs are those that focus on input privacy and those that focus on output privacy.
Input privacy concerns how parties can manipulate data to prevent it from being used outside of a defined context, while output privacy focuses on modifying calculation results so that output data cannot be used to trace back to original inputs. In this document, we will provide an introduction and overview of PETs by exploring various approaches in the literature. We will conclude this document by discussing the challenges in the adoption of these privacy-preserving technologies.
Our aim throughout this paper is to provide a comprehensive understanding of PETs, their application, and the hurdles that must be overcome for widespread adoption. The implementation of Privacy-Enhancing Technologies (PETs) enables the creation of secure data life cycles, promoting collaboration, trust, and security among those with a stake in the data.
Author abstract reproduced from EasyChair Preprint 9814, published 2 March 2023. Read the preprint PDF.
]]>