Search: “differential privacy”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Differential Privacy Meets Fixed Parameter Tractability: Algorithms and Lower Bounds

Theory paper combines differential privacy with fixed-parameter tractable encoders, improving approximation guarantees for combinatorial optimization and proving new lower bounds.

The paper studies combinatorial optimization under epsilon-differential privacy within the implicit encoder-decoder framework of Gupta et al. (SODA 2010), generalizing it to allow fixed-parameter tractable encoders. This circumvents approximation barriers inherent to polynomial-time algorithms and yields improved guarantees for fundamental combinatorial optimization problems. The authors establish the first representation-independent lower bounds: assuming a non-uniform variant of the Gap Exponential Time Hypothesis, no epsilon-DP encoder-decoder pair can achieve certain approximation guarantees with a subexponential-time decoder for sufficiently small epsilon. Representation-dependent lower bounds are also provided for larger epsilon.

arXiv cs.CR·Sep 11, 07:13 UTC · 5d agoResearch

18

Privacy-enhanced federated learning via asynchronous aggregation and local differential perturbation

Federated learning framework combining dynamic differential privacy, homomorphic encryption, and local DP retains 82.6% accuracy at epsilon 0.1 while cutting communication 21.3%.

The paper proposes a privacy-enhanced federated learning framework integrating Dynamic Differential Privacy, lightweight Homomorphic Encryption, and Local Differential Privacy during training. An asynchronous aggregation strategy with version control supports distributed training in asynchronous environments. On CIFAR-10 and Purchase-100, the method maintains up to 82.6% classification accuracy under stringent privacy constraints (epsilon = 0.1) and reduces communication overhead by 21.3% versus FedAvg.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 17:12 UTC · 2d agoAI research

15

Differentially Private EEG Feature Anonymization: A Privacy-Utility Case Study in Clinical Neurophysiology

Case study applies Gaussian and Laplace differential privacy to clinical EEG features, quantifying privacy-utility trade-offs across three deployment scenarios.

Researchers evaluate subject-level differential privacy for EEG-derived feature representations using Gaussian and Laplace perturbations across client-side, centralized server-side, and decentralized local training scenarios. Utility is assessed with statistical measures and a downstream machine-learning check on clinical neurophysiology data. Results show DP can be integrated into EEG workflows, but mechanism choice, privacy parameters, and sensitivity calibration strongly influence data utility, particularly on small and imbalanced clinical datasets. The study highlights the privacy-utility trade-off in protecting biomedical signals against re-identification and inference risks.

arXiv cs.CR·Sep 10, 16:31 UTC · 6d agoResearch

28

Privacy-Aligned Personalized Federated Learning with Compact Adaptation and Variable-Length Gaussian Communication

Paper releases a private client context once and confines adaptation to coefficients, matching full-model differential privacy with 2.67x less uplink on CIFAR-10.

The paper addresses the dimensionality misalignment between record-level differential privacy and low-dimensional client variation in personalized federated learning by releasing a private client context once and restricting repeated adaptation to a fixed coefficient space. A variable-length quantized Gaussian mechanism lets quantization error itself serve as the required privacy perturbation. On MNIST and CIFAR-10, the design matches or outperforms full-model private adaptation across privacy budgets and client heterogeneity while cutting protected uplink 2.67x at epsilon=16 on CIFAR-10.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 17:48 UTC · 2d agoAI research1

25

Subgroup Membership Inference Audits of Differentially Private Synthetic Text

Audits of 32 differentially private synthetic-text releases show subgroup membership leakage is concentrated in few records and systematically underestimated by average-case attacks.

The paper defines a subgroup-targeted membership inference game in which the target pool is an explicit parameter, to audit residual leakage in differentially private synthetic text releases. The audit instantiates 32 proxies across four datasets, three generators (DP-SGD fine-tuning, API-based prompting, and activation steering), and five privacy budgets. DP substantially reduces average leakage at every budget, but remaining leakage is concentrated: roughly a tenth of records carries about 40% of it, and the noise removes more measured leakage from random records than from high-risk ones. Which records leak depends on the release mechanism, so record-level risk cannot be assessed independently of the release.

arXiv cs.CR·Sep 9, 07:56 UTC · 7d agoResearch

45

Machine Unlearning as Private Retroactive Algorithms

A cs.CR paper defines private retroactive algorithms, showing machine unlearning is a data-maintenance problem and giving DP constructions for linear statistics, clustering, histograms.

The paper argues that machine unlearning's requirement to emulate retraining from scratch carries no meaningful privacy semantics against adversaries observing sequences of releases, recasting it as a data-maintenance question addressed by retroactive algorithms. It defines private retroactive algorithms, combining retroactivity with differential privacy under continual observation. Constructions achieve privacy and retroactivity at no asymptotic cost over privacy alone for linear statistics, clustering, and histograms, alongside impossibility results.

arXiv cs.CR·Sep 4, 16:32 UTC · 12d agoResearch

30

SpliTEE: Improving LLM Inference on Trusted Hardware with Differentially Private GPU Outsourcing

SpliTEE splits LLM inference between Intel TDX trusted execution and untrusted GPUs, using differential privacy instead of encryption to protect intermediate representations.

SpliTEE extends split inference to LLMs, running inference partly inside an Intel TDX TEE while masking intermediate inputs sent to untrusted GPUs with differential privacy rather than encryption. The authors show a prompt-reconstruction attack recovers nearly 80% of prompts from unmasked intermediate representations, motivating the masking. A global sensitivity analysis bounds the required DP noise scale, avoiding quantization and keeping models in floating point. The implementation is nearly twice as fast as full CPU-based TDX inference and 5-15 seconds faster than encryption-based Slalom with higher accuracy, evaluated on Llama-3.2-3B and Qwen3-4B.

arXiv cs.CR·Sep 14, 04:55 UTC · 2d agoResearch

34

Distributed and Private Textual Data Synthesis from Embeddings

Researchers propose a distributed differentially private text synthesis method combining DP summaries and secure protocols, removing the need for a trusted curator.

The paper presents a differential privacy and cryptography co-design for synthesizing textual training data without a trusted curator or tightly synchronized user participation. It releases a one-time DP summary in embedding space, identifying frequent semantic regions and their DP centroids to enable training-free offline text synthesis, with semantic support protection to avoid exposing rare user texts. A custom secure protocol enforces end-to-end DP guarantees over distributed user data. Across four benchmarks the approach achieves utility comparable to the state-of-the-art centralized DP synthesis method.

arXiv cs.CR·Sep 9, 12:33 UTC · 7d agoAI research

25

Privacy Failure in Split-LLM Training, The Returned Gradient Nullifies the Decoys

Researchers show split-LLM training leaks privacy via zero-valued gradients on decoy rows, exposing which activations are real despite passing forward-channel checks.

A systems-security case study of a two-node split-LLM training setup found that the returned output gradient from an Untrusted Cloud Node is exactly zero for decoy rows, revealing which rows are real. Across nine seeds, zero patterns identified real rows in 4,096 of 4,096 frames per run, and an attack on frame contents recovered 0.65 to 1.50 percentage points of extra tokens over a baseline. Both datasets passed forward-channel privacy and quality checks but failed once the returned gradient was included. Row-wise gradient clipping and noise closed the leak for roughly 0.01 nats of held-out cross-entropy, though five unmeasured attack classes remain.

Hugging Face daily papers·Sep 2, 20:00 UTC · 14d agoAI safety & security

58

Predicting Privacy Leakage from Weight Spectral Density

Study shows WeightWatcher spectral metrics like stable rank correlate with membership inference vulnerability, enabling cheaper ML privacy auditing.

The paper tests whether spectral metrics from the heavy-tailed self-regularisation framework can proxy membership inference attack (MIA) vulnerability without training expensive shadow models. On image and tabular classification tasks, stable rank correlates positively with overall MIA success, while Log alpha-Norm correlates negatively at the low false-positive regime. These correlations are stronger than those obtained from the generalisation gap, suggesting weight spectra capture leakage information overfitting measures miss. The authors propose spectral analysis as a scalable direction for privacy auditing.

arXiv cs.CR·Sep 10, 16:34 UTC · 6d agoResearch

32

RegionFed: Federated Learning for Personalized Query Understanding in Heterogeneous Retail Environments

RegionFed is a gradient-level federated learning framework enabling personalized retail query understanding while matching centralized accuracy with differential privacy.

RegionFed is an architecture-robust federated learning framework for personalized query understanding that operates at the gradient level, using the l2 conflict between regional and global gradients to diagnose heterogeneity and control personalization. Existing parameter-level personalized FL methods collapse on transformers, falling below 10% accuracy on T5, while RegionFed deploys unchanged on T5-Small, T5-3B, RoBERTa, and CNNs. RegionFed-Meta achieves 92.27% across Amazon ESCI, Amazon Reviews, and LEAF-FEMNIST, within 0.23 percentage points of the centralized upper bound, with epsilon-approx-0.60 differential privacy.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:50 UTC · 12d agoAI research1

30

Chinese AI firms are siphoning capabilities from American models, CISA warns

CISA, NSA and FBI warn Chinese AI firms including DeepSeek and Moonshot AI extracted billions of tokens from US frontier models via distillation campaigns.

A joint CISA, NSA and FBI advisory says China-based firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have run industrial-scale knowledge distillation campaigns against US frontier models such as Claude, GPT, Gemini and Grok since at least late 2024, likely with Chinese government knowledge. The campaigns used gray-market API proxies called transfer stations, premium account pools and traffic routing to bypass restrictions, evade safeguards and exfiltrate billions of tokens used to train models like DeepSeek R1/V3 and Kimi. The agencies challenge DeepSeek's reported $5.6 million training cost and recommend identity verification, usage monitoring, response variation, differential privacy and indicator sharing as defenses.

Help Net Security·Sep 9, 09:55 UTC · 7d agoAdvisory in the wild1

70

Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference

Attack breaks permutation-based model confidentiality in hybrid FHE inference, recovering all ResNet-20 linear layers exactly with d+1 queries per layer.

The paper shows output-permutation plus noise fails to protect model confidentiality in hybrid FHE inference: d+1 admissible queries recover an exact permutation-invariant summary of a d-input linear layer, and shuffle-model DP amplification premises cannot hold under correctness-bounded noise. The authors recovered all linear layers of a Safhire-style ResNet-20 end-to-end from TFHE transcripts with zero error, using 5,712 total queries. Exact per-layer recovery was also confirmed on pretrained ImageNet-scale CNNs and ViT-B/16. Leaked layer spectra enable model fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.

arXiv cs.CR·Sep 11, 14:37 UTC · 5d agoResearch1

45

Trust-Aware Adaptive Disclosure for Inference Privacy Preservation in Multi-Agent Networks

Researchers propose a trust-aware privacy framework for multi-agent systems that adapts message disclosure to reduce goal inference attacks.

The cs.CR paper addresses privacy-preserving consensus in networked multi-agent systems where observing adversaries attempt to infer each agent's hidden goal from its messages. A Trust-Aware Privacy Control framework uses a trust-dependent stochastic policy to adapt information release, trading off consensus performance and privacy. Experiments show reduced adversarial goal inference accuracy versus representative baselines while maintaining competitive consensus utility, with relevance to deployments such as healthcare management and smart grids.

arXiv cs.CR·Sep 4, 16:44 UTC · 12d agoResearch

28

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

NSA, CISA, and FBI warn DeepSeek, Alibaba, and other Chinese AI firms ran industrial-scale distillation of U.S. frontier models, threatening U.S. AI leadership.

A joint NSA, CISA, and FBI Cybersecurity Advisory (AA26-251A) says China-based firms DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from U.S. frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government knowledge. Campaigns running since at least late 2024 used native APIs, cloud providers, third-party aggregators, gray-market proxy "transfer stations", and shared premium subscriptions to bypass geographic restrictions, evade safeguards, and violate providers' terms of use. The agencies recommend detecting anomalous prompts, accounts, and usage patterns; subtly altering responses to suspected distillers; and cross-organization intelligence sharing. They also call DeepSeek's publicly cited $5.6M training cost misleading because it excludes data acquired through distillation.

CISA Advisories·Sep 8, 12:00 UTC · 8d agoAdvisory in the wild1

76

Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting

Researchers show HTTP/2 features can emulate website fingerprinting defenses like FRONT and Tamaraw with tunable privacy-overhead trade-offs.

An arXiv paper demonstrates that application-layer defenses such as HTTPOS, LLaMA, FRONT, ALPaCA, and Tamaraw can be emulated through HTTP/2 features at both the client and server side, including proactive resource suggestion, multiplexing, and flow control. The authors propose a unified evaluation blueprint that calibrates defense parameters per dataset, combines practical attacks with information-theoretic leakage estimators, and measures overheads to map each defense's privacy-overhead trade-offs.

arXiv cs.CR·Sep 4, 13:16 UTC · 12d agoResearch

30

US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities

NSA, CISA and FBI warn Chinese AI firms including DeepSeek and Moonshot systematically extracted billions of tokens from US frontier models since late 2024.

The NSA, CISA, and FBI report that China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from US frontier models such as Claude, GPT-4/GPT-5, Gemini, and Grok 4 since late 2024. The distillation trained DeepSeek's R1 and V3 and Moonshot's Kimi-K2/K3 models, and the agencies mapped the tactics to MITRE ATLAS while noting additional novel techniques like subscription exploitation and request metadata sanitization. They describe the activity as a strategic economic threat to US technological leadership and recommend behavioral detection, differential privacy, and targeted cost-imposing responses.

SecurityWeek·Sep 9, 12:32 UTC · 7d agoAI safety & security in the wild1

84

PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA

PrivAudit framework audits 998 websites for CCPA compliance, finding stronger disclosures but pervasive, weakly responsive third-party cookie tracking.

PrivAudit is an automated dual-lens auditing framework combining LLM-based analysis of privacy policies grounded in CCPA provisions with automated browser measurements of cookie writes under diverse privacy configurations. Applied to 998 websites, it finds CCPA-subject sites disclose opt-outs, data sharing, and user rights more frequently, yet tracking remains pervasive: 6,392 targeting cookies, 49% third-party writes. Cookies show limited-to-moderate responsiveness to privacy signals and consent choices even when sites claim to honor them. The framework is open-sourced and shared with regulators.

arXiv cs.CR·Sep 9, 04:31 UTC · 7d agoResearch

20

CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok

CISA, NSA and FBI advisory says six Chinese AI firms extracted billions of tokens from Claude, GPT, Gemini and Grok via API proxies since late 2024.

A joint advisory from CISA, NSA and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI harvested billions of tokens across millions of exchanges from Claude, GPT, Gemini and Grok variants since late 2024. Operators allegedly used API proxy 'transfer stations', account pools, bulk premium subscriptions and prompt injection or jailbreak-style requests to force models to reveal chain-of-thought reasoning. DeepSeek's R1 and V3 and Moonshot's Kimi-K2 and Kimi-K3 models reportedly benefited from the extracted data. CISA urged providers to add identity checks, monitor subscription-to-usage ratios, rate limit, and share infrastructure signals with cloud platforms.

Cyber Security News·Sep 9, 08:41 UTC · 7d agoAI safety & security in the wild

72

Private Information Retrieval With Arbitrary Privacy Requirements: Introduction and Capacity Results

Researchers formulate private information retrieval under arbitrary graph-based privacy requirements, deriving capacity bounds and introducing pyramid storage graphs.

The paper generalizes classical private information retrieval (PIR) to arbitrary privacy requirements over graph-based storage systems, where each message is retrieved privately from a pre-specified server subset. The authors derive lower and upper capacity bounds for general graphs and exact capacity results for path and cyclic storage graphs. They also introduce a new pyramid storage graph structure that models symmetric message storage and replication patterns.

arXiv cs.CR·Sep 14, 17:03 UTC · 2d agoResearch

15

I Am No One: Style-Aware Paraphrasing for Text Anonymization

Prompt-driven style-aware paraphrasing with LLMs cuts authorship attribution F1 by 60-70% while preserving content quality.

The paper proposes a style-aware, prompt-driven anonymization approach using pretrained LLMs to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It addresses stylometric re-identification risks in anonymized text, including ASR transcripts of meetings and call-center calls where leakage persists after acoustic anonymization. Across blog and review datasets, the approach reduces authorship attribution F1 by 60-70%, substantially outperforming both DP-based and non-DP baselines while maintaining readability.

arXiv cs.CR·Sep 11, 02:07 UTC · 5d agoResearch

40

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

New gradient inversion attacks tied to erasure-coding theory recover 94–100% of ImageNet batches, showing federated learning privacy leakage is underestimated.

The paper connects gradient inversion in federated learning to erasure-correcting code theory, constructing analytic attacks that exceed previously known recovery bounds. The attacks recover batches exactly, with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks, even a passive attacker observing an honestly trained network recovers 94–100% of ImageNet batches up to size 128, and more than 90% actively at batch sizes of several hundred. The authors conclude that federated learning's privacy leakage has been underestimated.

arXiv cs.CR·Sep 9, 03:17 UTC · 7d agoResearch

28

Meta Releases Muse, a Personal AI Agent With Privacy ‘Built Into It’

Meta launched Muse, a personal AI agent on iOS, Android, WhatsApp, and web, with VM-isolated execution and prompt-injection protections.

Meta released Muse, a personal AI agent from Meta Superintelligence Labs that automates tasks such as sending email, booking travel, and making purchases, accessible via a dedicated app, Muse.ai, and WhatsApp. The agent runs in a Secure VM architecture that isolates untrusted web and integration data from the action-taking component, with a Sentinel system that routes human-in-the-loop approval prompts directly to users to resist prompt injection. Purchases use Stripe's Link single-use card numbers with no-fee return protections, and a future Confidential VM co-developed with Moxie Marlinspike will run in trusted execution environments with user-held keys. Meta added Muse to its public bug bounty with payouts up to $300,000, including up to $130,000 for single-user prompt injection findings.

WIRED · Security·Sep 8, 20:12 UTC · 8d agoAI industry

75

PIA-Bench: Towards Automated Privacy Impact Assessment with Large Language Models

Researchers release PIA-Bench, the first open benchmark evaluating how accurately LLMs can automate privacy impact assessments using 73 curated federal PIAs.

PIA-Bench is the first open benchmark for evaluating large language models on real-world privacy impact assessments (PIAs). The authors audited 499 expert-authored PIAs published by US federal agencies and curated 73 structured PIAs comprising 451 privacy risk items and 831 mitigation items. Off-the-shelf LLMs were found to produce meaningful assessments while identifying clear avenues for improvement. The paper calls for domain-specific LLM agent workflows, accountable LLM infrastructure, and new quality standards for PIAs.

arXiv cs.CR·Sep 11, 08:16 UTC · 5d agoResearch1

48

[AINews] Muse Spark 1.3 matches GPT-5.6-Sol, confirming Meta Superintelligence as the newest Frontier Lab, >90% discount for training

Meta's Muse Spark 1.3 reportedly ranks as the world's #3 model, matching frontier models from OpenAI and Anthropic with planned open weights.

The Latent Space AI News roundup leads with Muse Spark 1.3, promised in Zuckerberg's letter, which ranks #3 worldwide per AAII, is slated for open weights, and uses a pricing model over 90% cheaper when users opt in to training. The issue also covers the rumored Gemini 3.8 Flash launch and analysis arguing OpenAI's rumored looped-transformer 'Astra' architecture is a modest tweak rather than a breakthrough. Additional coverage includes ByteDance Seed's HarnessDev harness-evaluation benchmark, a retrieval-invoked actual-use evaluation method, Stanford's revamped agent engineering curricula, and Photon 2.1 adding TTS models and NVIDIA B200 support.

Latent Space·Sep 3, 04:38 UTC · 13d agoModel release1

74

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning

Researchers show colluding nodes in decentralized federated learning can reconstruct private updates despite secure aggregation, using lattice-based attacks tied to the Hidden Subset Sum Problem.

Secure aggregation in decentralized federated learning is widely assumed to hide individual model updates. The authors show that sparse decentralized topologies give colluding semi-honest nodes asymmetric aggregate views exposing hidden linear combinations of honest participants' private states. They establish a formal connection to the Hidden Subset Sum Problem and design a lattice-based reconstruction approach combining lattice reduction with structural filtering. Evaluations on image, tabular, and text tasks show attackers recover local updates and can reconstruct private training data.

arXiv cs.CR·Sep 8, 09:20 UTC · 8d agoResearch

45

Topological Fraud Detection in Latent Transaction Spaces

Researchers present a privacy-preserving fraud detection method combining unsupervised filtering and supervised classification on anonymized transaction embeddings for low-latency triage.

The paper describes fraud detection performed entirely on topologically anonymized transaction embeddings. It iterates unsupervised filtering followed by supervised classification ('sniping') to flag suspicious activity. The goal is ultra-low-latency, privacy-preserving triage for institutions without exposing personally identifiable information.

arXiv cs.CR·Sep 8, 08:50 UTC · 8d agoResearch

22

Apple CEO John Ternus says the best AI device is still the iPhone

Apple CEO John Ternus said the iPhone is the best AI device, emphasizing on-device processing and privacy in Apple's AI strategy.

At Apple's Surprise and Shine event, new CEO John Ternus, who succeeded Tim Cook (now executive chairman), framed the iPhone as the ideal 'intelligent personal hub' for AI. He listed requirements including on-device AI processing, personal context awareness, high-quality cameras and microphones, long battery life, and seamless integration with other devices. Ternus contrasted Apple's privacy-first approach with rivals' data collection, saying Apple Intelligence runs on device whenever possible.

TechCrunch · AI·Sep 9, 17:36 UTC · 7d agoAI industry1

32

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.

Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.

arXiv cs.CR·Sep 9, 09:51 UTC · 7d agoResearch

45

Six Chinese AI firms accused of aggressively copying US frontier models

NSA, CISA, and FBI accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of industrial-scale distillation of US frontier models via API abuse.

A joint NSA, CISA, and FBI release alleges six Chinese AI firms have extracted capabilities from US frontier models, including Claude, GPT, Gemini, and Grok, since at least late 2024, likely with Chinese government awareness. Tactics include bulk procurement of premium subscriptions with fraudulent accounts, proxy routing to evade geo-restrictions, and prompt injection to force models to reveal hidden chain-of-thought reasoning. Agencies recommend stronger identity verification, monitoring of anomalous usage, and quietly downgrading or adding noise to responses for suspected distillers, while warning these mitigations could frustrate legitimate users.

Ars Technica · AI·Sep 9, 20:06 UTC · 7d agoAI safety & security in the wild

78

ROSETTA: Efficient and Accurate Privacy-Preserving LLM Decoding via Hybrid CKKS/TFHE Evaluation

ROSETTA is a hybrid CKKS/TFHE homomorphic encryption framework for privacy-preserving LLM decoding, achieving up to 4.8x Softmax and 2.1x end-to-end speedups.

The paper proposes ROSETTA, a hybrid CKKS/TFHE fully homomorphic encryption framework for private inference on generative LLMs, targeting the nonlinear operations that dominate autoregressive decoding cost. It introduces an adaptive segmented lookup-table protocol based on TFHE and a scheme-aware operator-selection framework that assigns each nonlinear operator to CKKS or TFHE to minimize latency. Experiments show up to 4.8x Softmax speedup and 1.5-2.1x end-to-end decoding speedup over the state-of-the-art CacheMir framework.

arXiv cs.CR·Sep 15, 09:51 UTC · 1d agoResearch

28

The GTA VI leaks are breaking the internet. Security researchers have seen this before.

A hacker or insider leaked GTA VI gameplay footage before launch, triggering Take-Two DMCA subpoenas against Discord, Google, Microsoft and X.

The persona "CyberLeek" published stolen Grand Theft Auto VI gameplay footage and a manifesto, in what experts call a familiar data extortion playbook with monetization via watermarks, crypto wallets and a memecoin. Take-Two Interactive obtained DMCA subpoenas against Discord, Microsoft and X, and sent copyright notices to Google, treating the case like an insider threat investigation. GTA VI is projected to earn $3.3–5.2 billion in launch-week sales, raising financial and reputational stakes. Related leak websites went offline after the subpoenas.

CyberScoop·Aug 26, 01:54 UTC · 21d agoData breach

72

EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media

EU Commission President von der Leyen warned AI will enable unprecedented hacking and announced Kids Act and Digital Fairness Act proposals regulating social media.

In her State of the European Union 2026 speech, Ursula von der Leyen warned that upcoming AI models 'will allow hacking on a level we never thought possible' and cited dangers of self-improving models, referencing a Hugging Face incident. She reaffirmed the AI Act as the core guardrail framework and pledged cooperation with Canada, the UK, and other partners. She also proposed a Kids Act banning social media under age 13 and personal accounts under 15, plus a Digital Fairness Act to be proposed in autumn.

SecurityWeek·14:15 UTC · 6h agoAI policy

48

Stealing AI Reasoning Traces

Researchers demonstrate a decryption jailbreak that extracts encrypted reasoning traces from Anthropic, OpenAI, and Google LLM APIs via weaker sibling models.

The paper exploits the fact that encrypted chain-of-thought blocks returned by LLM providers are interchangeable across sessions, users, and models within a provider's ecosystem. Injecting an encrypted trace into a weaker, less-safeguarded model from the same provider forces it to output the trace in plaintext, bypassing anti-distillation mechanisms. Decoding 315,320 reasoning blocks scraped from public repositories recovered 367 PII artifacts and 182 credentials, showing large-scale private data leakage. The flaw also enables hidden hazardous information disclosure and invisible prompt injections embedded in encrypted blocks; mitigations were proposed after responsible disclosure.

Schneier on Security·Sep 8, 10:20 UTC · 8d agoAI safety & security

58

Panic builds over bankrupt Spirit’s looming data sale to Google

Startups object to Google's bankruptcy-auction purchase of Spirit Airlines operational data, claiming proprietary IP is being sold without consent.

Google won an auction to acquire a large enterprise dataset from bankrupt Spirit Airlines, which it says will help improve its products and AI models, with no personal information included. Springshot, whose airline logistics platform powered Spirit's stack, filed a limited objection arguing the vaguely defined data categories could transfer third-party IP and trade secrets it owns; International Aero Engines filed a similar objection. The EFF called it the first public bankruptcy proceeding over selling company and employee data as an asset, and objectors warn of a precedent letting large companies acquire startup IP through bankruptcy courts.

Ars Technica · AI·Sep 10, 18:14 UTC · 6d agoAI industry

45

Why User Studies and Participant Experience Reporting Matter for VR Motion Privacy?

User studies explain VR motion privacy mechanism acceptance far better than physical deviation metrics, a study of three mechanisms finds.

The paper examines how well physical deviation predicts user acceptance of VR motion privacy mechanisms compared to user studies, testing three mechanisms at five deviation levels. User studies explain substantially more variation in mechanism acceptance, though physical deviation remains significant, and prior VR experience affects acceptance. Public VR game leaderboards expose motion recordings from hundreds of thousands of users, creating identification and profiling risks. The authors recommend combining physical deviation metrics with user studies and reporting participants' prior experience.

arXiv cs.CR·Sep 11, 04:08 UTC · 5d agoResearch

22

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net Security·Aug 26, 09:46 UTC · 21d agoIndustry

10

Accountability in Certificate Transparency and Variants

Formal Dolev-Yao analysis shows plain Certificate Transparency requires an honest log, SCT Auditing removes that assumption, and Gossiping does not.

The paper analyzes accountability in Certificate Transparency and its SCT Auditing and Gossiping extensions in the Dolev-Yao model, starting from a vanilla PKI. It finds plain CT provides accountability only under the assumption of an honest log. The SCT Auditing extension can eliminate that assumption, while the Gossiping extension cannot. CT is supported by all major browsers and obliges Certificate Authorities to record issued certificates in public, monitored logs.

arXiv cs.CR·Sep 10, 13:45 UTC · 6d agoResearch

27

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security News·Sep 9, 07:45 UTC · 7d agoIndustry

14

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.

Check Point Research found a covert bidirectional channel between ChatGPT code-execution containers belonging to different accounts, which were supposed to be isolated from each other and the public internet. Both could reach the same internal JFrog Artifactory instance used for package delivery, whose exposed Item Management API allowed a 'shared clipboard' between containers. In a proof of concept, a hidden instruction in a shared conversation made ChatGPT retrieve email data from the victim's connected Gmail account and send it to the attacker's account while the victim received a normal answer. The same channel could exfiltrate conversation history and session files; OpenAI recently described a similar isolation weakness in its postmortem of the Hugging Face incident.

Check Point Research·Sep 8, 13:00 UTC · 8d agoAI safety & security1

68